Hi Imran. I think you could use the percentiles aggregation can find the median (50th percentile).
For example I created this expression to return only the 50th percentile for a packetbeat field. .es(index=packetbeat-*,metric=percentiles:http.response.body.bytes:50)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.