How can I get the count of documents, clipped at a maximum by using only the Lucene query string?

Elastic Stack Elasticsearch
1

I am trying to graph the count of log-messages of several applications in a graph. But some applications send a log more logs than others. So the idea was to graph something like the following for each application (as SQL):

SELECT MAX(COUNT(*), 1) FROM log_messages;

This would give me either 1 or 0, depending if there are messages or not (which is exactly what we are looking for). This value could then be easily stacked in a graph. We use this in Grafana, and it seems that there is no way to combine the max and count functions in this manner.

Is there a way to do this?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.