create_transform.json

PUT _transform/test
{
  "source": {
    "index": [
      "apm-*-span"
    ],
    "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "agent.name": "rum-js"
            }
          },
          {
            "wildcard": {
              "destination.address": "*XXX.com"
            }
          },
          {
            "terms": {
              "span.type": [
                "external",
                "resource"
              ]
            }
          }
        ]
      }
    }
  },
  "dest": {
    "index": "test",
    "pipeline": "rollup_web_infra"
  },
  "frequency": "10m",
  "sync": {
    "time": {
      "field": "@timestamp",
      "delay": "60m"
    }
  },
  "pivot": {
    "group_by": {
      "@timestamp": {
        "date_histogram": {
          "field": "@timestamp",
          "calendar_interval": "1h"
        }
      },
      "source.country_name": {
        "terms": {
          "field": "client.geo.country_name"
        }
      },
      "source.region_name": {
        "terms": {
          "field": "client.geo.region_name"
        }
      },
      "service.name": {
        "terms": {
          "field": "service.name"
        }
      },
      "destination.address": {
        "terms": {
          "field": "destination.address"
        }
      },
      "span.subtype": {
        "terms": {
          "field": "span.subtype"
        }
      }
    },
    "aggregations": {
      "duration.us.max": {
        "max": {
          "field": "span.duration.us"
        }
      },
      "duration.us.percentiles": {
        "percentiles": {
          "field": "span.duration.us",
          "percents": [
            50,
            75,
            95,
            99
          ]
        }
      },
      "transactions_count": {
        "cardinality": {
          "field": "transaction.id"
        }
      },
      "traces_count": {
        "value_count": {
          "field": "trace.id"
        }
      }
    }
  },
  "description": "Web to infra servers HTTP calls",
  "settings": {
    "max_page_search_size": 500
  }
}