Query Elasticsearch .monitoring indices for periods of time when the cluster status was red

cluster_state.status:red.json

GET .monitoring-es*/cluster_state/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "cluster_state.status": "red"
          }
        },
        {
          "range": {
            "timestamp": {
              "gte": "2017-07-29T00:00:00.000Z"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "red": {
      "date_histogram": {
        "field": "timestamp",
        "interval": "day",
        "min_doc_count": 1
      }
    }
  }
}