I got it working.
I first parsed the log line with | json and extracted the latitude and longitude fields. within the json parsing I renamed the field from its original naming DstLocation_longitude and DstLocation_Latitude to lon and lat .
then I did a count_over_time(...[$__auto]) to count the amount of these logs
and the last step was to do a sum by (lon,lat) (....) and the Panel could autodetect the lon/lat values and place the marker correctly.
Later I extracted a few more json fields like country, region, city, dstAddr and added this to the sum by () to make it available in the geolocation tooltip.
