JSON Input allows for manually setting aggregation parameters that do not have GUI inputs. None of the aggregations support query as a parameter so you can not filter aggregation results in this way.
Try using the timelion visualization. That visualization allows for specifying specific queries per metric. For example, the following expression displays a unique count metric for two filters .es(index=logstash-*,q='machine.os.raw:ios',metric=count), .es(index=logstash-*,q='machine.os.raw:osx',metric=count)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.