I have data ingested from logs. There is a "log_level" field for each message with possible values of ["INFO", "WARNING", "ERROR"]
I want a bar chart that shows the count of each log level in hourly intervals. So I should have a bar segment for each log level that represents the number of matching documents for that hour.
My first pass at this was to create a Visualization that had 3 counts for Y axes, one for each log level and then adding a query in the JSON input section. That just gave me 3 segments of equal length for each time slot.
I then tried to use sum in the Y axis to get a count of log_level, but it does not appear as a field that I can use.
Not exactly sure how to go about this. I am going to do some digging on the docs, but if anyone can point me in the right direction I would really appreciate it.