Problem with unique count and cardinality

Elastic Stack Elasticsearch
1

There are the following fields:

  • documentnumber
  • user (user identifier)
  • @timestamp field

I want to create the following monitoring (as EQL or other query, as alert and if possible in dashboard form) in Kibana: Show the unique users and document numbers for which >= 10 unique users request the same document number in the previous 24 hours.

When creating an aggregation in a visualization, a unique cardinality issue is encountered. This particularly occurs when the aggregation is performed on the Y-axis of a visualisation.

2

Hi Peter K, you've tagged the question as "Enterprise App Search", but I see that your question is more of a general Elasticsearch question, is it correct?

3

That's correct, but could not choose Elasticsearch when creating the post

4

I've moved the topic into Stack / Elasticsearch, this would be the correct forum category for the question.

That will give more visibility to this post and increase likelihood of getting the answer you need!