I have events which contains a numeric field action.id.
When I filter action.id to be present for these events and aggregate for count and unique count I get different values.
I understand it this way, that one or some action.ids have a count of more than one.
Currently I am talking about 100,000 messages.
I need to retrieve all events, where the action.id occurs in more than one event.
How do I do this?
Can I do it in kibana?