On which days did we not meet our SLAs (95% of the requests took less than 500ms)?

eng i aggs q

# On which days did we not meet our SLAs (95% of the requests took less than 500ms)?

GET logs_server1/_search?filter_path=**.key_as_string
{
  "size": 0,
  "aggs": {
    "logs_by_day": {
      "date_histogram": {
        "field": "@timestamp",
        "calendar_interval": "day"
      },
      "aggs": {
        "p95": {
          "percentiles": {
            "field": "runtime_ms",
            "percents": [
              95
            ]
          }
        },
        "sla_filter": {
          "bucket_selector": {
            "buckets_path": {
              "kpi": "p95[95.0]"
            },
            "script": "params.kpi > 500"
          }
        }
      }
    }
  }
}