Transform: Sum doesn't add up

Yes, missing_bucket requires >=7.10.0, however you can use a script (>=7.7.0), e.g.

"script": { 
            "source": "if (doc['domain'].value == null) {return "unknown_domain";}return doc['domain'].value;",
            "lang": "painless"
          }