I'm struggling to find the rate that a certain strings appears per second. So far I have this:
.es(index=myindex-*, q='@message: "specific string"').scale_interval(1s)
When I zoom in I can see it does split it out by second (and seems accurate) but zooming out I think it gives me the average for that interval. Ideally, I want to show the max rate per second (for that interval) - I'm not sure if this is possible however.
Any help appreciated!