So something like: https://logstash.wikimedia.org/app/visualize#/edit/a2d1a480-473d-11ef-8912-517dff44673b?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-1M,to:now))&_a=(filters:!(('$state':(store:appState),meta:(alias:!n,disabled:!f,index:'logstash-*',key:outgoingReqResult.hostname.keyword,negate:!t,params:(query:en.wikipedia.org),type:phrase),query:(match_phrase:(outgoingReqResult.hostname.keyword:en.wikipedia.org)))),linked:!f,query:(language:kuery,query:''),uiState:(),vis:(aggs:!((enabled:!t,id:'1',params:(),schema:metric,type:count),(enabled:!t,id:'3',params:(exclude:'200',field:outgoingReqResult.status.keyword,include:'',missingBucket:!f,missingBucketLabel:Missing,order:desc,orderBy:'1',otherBucket:!f,otherBucketLabel:Errors,size:5),schema:bucket,type:terms),(enabled:!t,id:'2',params:(field:outgoingReqResult.hostname.keyword,missingBucket:!f,missingBucketLabel:Missing,order:desc,orderBy:'1',otherBucket:!f,otherBucketLabel:Other,size:100),schema:bucket,type:terms)),params:(perPage:10,percentageCol:Count,showMetricsAtAllLevels:!f,showPartialRows:!f,showTotal:!f,totalFunc:sum),title:'Top%20errors%20by%20requested%20domain',type:table))

But the "count percentage" there is percent of all errors which is not what I want. I want on a per domain basis what percent are !200s

"Count Percentage" isn't a calculation that OpenSearch returns in its response. It's not even a percent of all hits returned by the query. Count percentage is calculated client-side by dividing each leaf aggregation doc_count by the sum of all branch root aggregations doc_count. This makes it heavily influenced by the size parameter.

I don't think it's possible in the current implementation. OpenSearch Dashboards would need a new feature to do it.

In T377828#10250601, @colewhite wrote:

"Count Percentage" isn't a calculation that OpenSearch returns in its response. It's not even a percent of all hits returned by the query. Count percentage is calculated client-side by dividing each leaf aggregation doc_count by the sum of all branch root aggregations doc_count. This makes it heavily influenced by the size parameter.

I don't think it's possible in the current implementation. OpenSearch Dashboards would need a new feature to do it.

Ok, good to know then. I wasn't sure if it was just that I couldn't figure out or if it really wasn't possible!