datafeed_low_request_rate_ecs.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "query": {
      "bool": {
        "filter": [
          { "term":  { "event.dataset": "nginx.access" } }
        ]
      }
    },
    "aggregations": {
      "buckets": {
        "date_histogram": {
          "field": "@timestamp",
          "fixed_interval": "15m",
          "offset": 0,
          "order": {
            "_key": "asc"
          },
          "keyed": false,
          "min_doc_count": 0
        },
        "aggregations": {
          "@timestamp": {
            "max": {
              "field": "@timestamp"
            }
          }
        }
      }
    }
}