We are inserting records in one elastalertic search index(test_elastalert1) and applying elastalert rules and formulas to find matched records and trigger email for matched ones. These matched records are inserted into other elasticsearch index (elastalert_status). We have created alias for these two indexes and created one index pattern to use it in visualize to create line chart.
We want to create line chart with showing count as y-axis and get time filed from the test_elastalert1 for x-axis to display how many events are inserted . Now we want to add sub-buckets to use term(alert_sent) from elastalert_status to display how many events are alerted(based on alert_sent = true). Alert_sent is Boolean type. Can anyone let me know how to use sub-buckets using Boolean field(alert_sent :true)?