Let me get back to this:
-
I was mostly looking at the JSON query and response since those are much easier to figure out than the Lens screenshot.
-
If you switch the bucket size from day to week, I'm not surprised the results change — you are moving from average per day to average per week, which is different.
-
I'm not sure how you want to get the daily average out of a pie chart. Shouldn't that be a bar chart with one bar per day? Like this:
I have a different dataset, but daily average:
With special care to make the buckets 1 day each (click on the
@timestamp
field to pick this interval):
PS: 20MB for one index is very small — you're having a lot of overhead just from the amount of shards. Either switch to monthly indices or use ILM to create them with 50GB each.