I am a bit confused:
All our documents are shipped via filebeat. Filebeat allways adds the meta information field
offset (position in logfile) - so far my understanding.
If I filter for a single logfile, then the unique count of offset field should be identical to the count, as long I have no duplicates. Am i correct?
But kibana shows different values. Lower number on unique counts means that there must be duplicates - my understanding.
Now I want to search the documents, where an offset appears more often, so I would like to run a term query on offset field and filter / sort for the number of occurrence:
When adding additional json options to the term aggregation
"min_doc_count" : 2
I get no results.
So the result is not what I expected. Can anyone shed some light on it?