Thanks, what is the desired outcome with the specification of the include: "WARNING" filter in the terms aggregation? what do you want to achieve with that? because this filters the returned bucket returning only buckets with that specific status and in your case seems that you don't have buckets on the selected interval to satisfy that clause: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_filtering_values_4
I'm also seeing that you are specifying also another time filter last minute and I think that will not produce the wanted result. I think this can be achieved with TSVB metric visualization as described in this other reply: Get visualization of missing data