I've got a Kibana chart that is displaying a rate, say "number of records processed/second" from a data source. I can have several hosts that are processing data. If I aggregate these using the "sum" method, then the values display correctly even if I filter some of the hosts out of the chart. But summing these rates over time does not provide meaningful data, since adding the rate for now and the rate five minutes ago is not meaningful.
My problem is that my interval is ">=1m". We have data points for every minute, but if I specify the interval for one minute, my chart can only hold 2000 data points. If I make the chart's timeline too long, the data cannot be displayed. If I set the aggregation to "max" or "avg", Kibana will combine data points and display the "max" or "avg" of the data for 5 minutes/an hour/a day depending on the length of time displayed on the chart. However, "max" only displays one of the hosts, and "avg" gives a meaningless value since some hosts usually have a rate of zero.
Is it possible for my Kibana visualization to "sum" each data point for a particular minute, but only display the maximum when data points are combined due to a long timeline? Am I stuck with forcing the interval to be "1min"?