Yup, this is what I was talking about earlier. It's actually showing you the top X (1, 3, whatever) per bucket. That is, per time interval. The fact that you only see 1 result when you choose Top 1 just means that the #1 path doesn't happen to change in your existing dataset, not that you are only ever going to get 1 result.
You could change the order of the buckets though, and you will get the limit you expect. That is, split the bars/lines/area first, with a Top X limit, and then add the Date Histogram on the X-Axis. This will show you only the top X values over whatever time range you are using in Kibana.
There's a tradeoff here though; if some buckets/time intervals don't contain one of the top X values, then you won't see all of the values for that interval; that is, you may see X-1 or less values on that bucket. The other, perhaps more serious tradeoff, is that some values may not show up even though they far outnumber the others.
Let's say you are looking for the top X
parameter values over the last 24 hours, grouped by hour. Elasticsearch queries that data in order, so it will actually query your data first over the last 24 hours first to get the top X values, and then show how those values break up for each hour. However, let's say that in the timeframe, you have 1 hour were a single
parameter was getting hammered and saw a TON of requests (say, it was a DoS attack or something)... but that only happened for an hour, or even a few minutes. In the grand scheme of things, over those 24 hours, that value is insignificant. It's probably important that you know about it, but it doesn't land in the top 5 for the last 24 hours, and won't show up at all.
That's the tradeoff. Do you only want to see the top X values over the entire time range, or do you want to see the top X values for each time bucket. Depending on what your answer is, you'll want to order the bucket configuration values on the visualization differently. Of course, you may decide that both are important, in which case you should create 2 different visualizations, and add both to a dashboard, so you get a better overall picture.
I hope that makes sense, but if anything still isn't clear, let me know.