You have the missing values enabled on your aggregation which is visible in your visualization editor. So missing is displaying the count of documents without the message.keyword in the last 24 hours.
You can also create a visualization using a saved search. Can you please try saving your search query in discover and creating a visualization based on it?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.