My indexes are broken up by log and day - for example:
logstash-service-log-2017.03.01
logstash-audit-log.2017.03.01
What I would like to do is use the metric visualization to show a count of all the entries in the "service-log" index (this would equate to "transactions per day"). When I use the metric visualization and the above service-log index, the value I get makes no sense -- mostly because it decreases!
Am I missing something fundamental?