We am struggling with an important visualisation for our team, not able to find the best way so I hope anybody can help me. It is related to thread pools elastic statistic, to give you an idea we can consider a simple data format, where reach record in an index has just node name and total number of rejected requests (it is a cumulative number so it only increments).
We would like to be able to see for which 5 nodes the number of rejected requests changed the most over last week or day.
One way we tried is using serial diff pipeline aggregation, but it works just over time and I am able to see are many changes of the count for the time pieces. Ideally we would need to do a sum over the aggregation, but it is not allowed.
We were also thinking about using a scripted field to create the serial difference on my own, but to do so, i would need to access other records using something like top hit when executing such script and did not find a way to do that.
If anybody has an idea how to do that, it would be awesome