Line chart with date histogram, split series and filter

Ah, I see your use case now. In visualizations adding a "split series" aggregation will always be applied to all series, so you can't separately configure a "total" series + the splits in individual series.

If that's suitable for your use case, you can create the splits manually by specifying a single "filters" split series aggregation. The "total" series would just become a filter "*" (matching all documents), for the other series you can specify the filters manually.

I think the problem you are hitting is the space in the field name - to use it in the lucene filter field, it should work by escaping the space with a backslash: infectious\ contact.keyword:"No"