gistfile1.txt

I am now trying to help you help me by giving you the commands to create the data in elasticsearch
so that we are talking about the same thing.

DELETE alerts

POST _bulk?refresh
{ "index" : { "_index" : "alerts", "_id" : "1", "_type" : "log" } }
{ "name" : "storage_controller_failure" }
{ "index" : { "_index" : "alerts", "_id" : "2", "_type" : "log" } }
{ "name" : "storage_controller_failure" }
{ "index" : { "_index" : "alerts", "_id" : "3", "_type" : "log" } }
{ "name" : "storage_controller_failure" }
{ "index" : { "_index" : "alerts", "_id" : "10", "_type" : "log" } }
{ "name" : "drive_corrupted" }
{ "index" : { "_index" : "alerts", "_id" : "11", "_type" : "log" } }
{ "name" : "drive_corrupted" }

GET alerts*/_search
{
  "size" : 0,
  "aggs": {
    "by_name": {
      "terms": {
        "field": "name",
        "size": 10
      }
    }
  }
}

Here is the response to the GET

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 5,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "by_name" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "storage_controller_failure",
          "doc_count" : 3
        },
        {
          "key" : "drive_corrupted",
          "doc_count" : 2
        }
      ]
    }
  }
}

Here I try to visualize using vega/v3
this way (which I think is what flash1293 is suggesting in https://discuss.elastic.co/t/how-can-i-visualize-aggregation-buckets-using-vega-not-vega-lite/194336

{
  "$schema":"https://vega.github.io/schema/vega/v3.json",
  
  
  "data": 
    [ {
      "name": "aggregations",
      "url": {
        "%context%": true,
        "%timefield%": "@timestamp",
        "index": "alerts*",
        "body" : {
          "size" : 0,
          "aggs": {
            "by_name": {
              "terms": {
                "field": "name"
              }
            }
          }
        }
      }
    } ],

 

 format: { property: "data.aggregations.buckets" },    

  "scales": [
    {
      "name": "yscale",
      "type": "linear",
      "zero": true,
      "domain": {"data": "aggregations", "field": "doc_count"},
      "range": "height"
    },
    {
      "name": "xscale",
      "type": "band",
      "domain": {"data": "aggregations",  "field": "key"},
      "range": "width",
      "padding": 0.05
    }
  ],
  
   "marks": [ {
    "type": "rect",
    "from": { "data": "aggregations" },
    "encode": {
      "update": {
        "x":     {"scale": "xscale", "field": "key"},
        "width": {"scale": "xscale", "band": 1},
        "y":     {"scale": "yscale", "field": "doc_count"},
        "y2":    {"scale": "yscale", "value": 0}
      }
    }
  } ]

 
}

I get no output
I feel I'm missing something obvious here.