My use case is to count errors vs non-errors in the dataset and use former being X % of latter as criteria to trigger an alert.
Am I correct with using filters aggregation to approach this alert?
Also, I've few grouping levels before I get the counts so I have few rows each with good and error counts in my payload aggregation.
After filter aggregation, I would like to eliminate zero error rows but could not use min_doc_count similar to terms aggregation. Could you point me to right direction here and also to iterate the aggregation payload rows to check X%?