When I use below I got the following error, and I am just trying to use the time range from the dashboard, anyone can help ?
(EsError: failed to parse date field [1738832413539] with format [strict_date_optional_time]: [failed to parse date field [1738832413539] with format [strict_date_optional_time]])
{
"$schema": ".json",
"data": {
"url": {
"index": "any-event*",
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"message.timestamp": {
"gte": {"%timefilter%": "min"},
"lte": {"%timefilter%": "max"}
}
}
},
{ "term": { "environment.keyword": "prod" } },
{ "term": { "message.affiliateName.keyword": "xyz" } }
]
}
},
"aggs": {
"false_count": {
"filter": { "term": { "message.hasException": false } }
},
"true_count": {
"filter": { "term": { "message.hasException": true } }
},
"total_count": {
"value_count": { "field": "message.hasException" }
}
}
}
},
"format": { "property": "aggregations.time_buckets.buckets" }
},
"transform": [
{
"window": [{"op": "rank", "as": "rank"}],
"sort": [{"field": "key", "order": "descending"}]
},
{
"filter": "datum.rank == 1"
},
{
"calculate": "datum.total_count.value > 0 ? datum.false_count.doc_count / datum.total_count.value * 100 : 0",
"as": "false_percentage"
},
{
"calculate": "datum.false_percentage >= 80 ? '#3ca951' : datum.false_percentage >= 70 ? '#efb118' : '#d62728'",
"as": "color"
}
],
"mark": {
"type": "text",
"fontSize": 100,
"fontWeight": "bold",
"background": { "field": "color", "type": "nominal" }
},
"encoding": {
"text": { "field": "false_percentage", "type": "quantitative", "format": ".1f" },
"color": { "field": "color", "type": "nominal", "scale": null }
}
}