I have an index in which I have a response status code for all my ELBs.
The question is what is the correct way to roll up this index and visualize it?
I tried to create a rollup job and use a value count for the field with the status code. But when I tried to use it for visualization it showed something wrong: the numbers of response codes are completely different than I have in raw data. I tried to use count for Y-axis and date histogram for X-axis. And I’ve added split series term aggregation for this field. And it looks like it counts the number of docs in the current index instead of using the aggregation.
So it is not clear what is the correct way to visualize value_count aggregation