I'm hoping someone can help me with my issue, as I feel it's a simple problem to solve and it's just me missing something! I'm fairly new to ELK (3 months in), so hopefully this isn't too much of a newbie question
I've attached a screenshot of a simple verticle bar chart to visualise what I'm trying to acheive. In the 'red' group, you have IDs that only have a single count, 75 in total. In the 'blue' group, you have ID's that have more than 1 count, 16 in total.
What I would like to do is create a simple metric to show the 75 in the red group as 'Single entry IDs', and another simple metric to show the 16 in the blue group as 'multiple entry IDs'.
I've tried reading up on pipeline aggregations, but if I'm honest it's tricky to follow as I'm still early on in my learning curve.
I've also tried the CURL request from this post - https://stackoverflow.com/questions/53359102/elasticsearch-count-duplicated-and-unique-values
However, that doesn't seem to work as it doesn't count the non-duplicate ID's properly (I get 0). It's also all in the console and I want this to be shown in Kibana!
Really hope that all makes sense, I've tried to explain it as best I can. Happy to assist with further info if needed.