Thanks @bogdan.pintea for your answer.
The data preview seems perfect:
But I'm having some troubles configuring the graph when I don't use as 'AS', seems something wrong with using "@timestamp".
So tried with 'AS':
SELECT COUNT(DISTINCT user.name) AS UniqueUsers, DATETIME_FORMAT("@timestamp", 'MMM') AS Month
FROM "nagios"
WHERE "@timestamp" > now() - interval 1 years AND event.dataset LIKE 'nagios.audit' AND MATCH(message,'Logged in')
GROUP BY DATETIME_FORMAT("@timestamp", 'yyyy-LL'), 2
Which produces:
But this is also ordered alphabetically..
So it seems to result in the same issue using "GROUP BY Month, MonthNumber".
Willem