Custom Background Sets for Significant Term Queries

[red-knight]

Users should be able to customize the background set for significant term queries when building visualizations in Kibana.

Specific use-case:

Determine unusual user activity by comparing last hour of logs with logs from the same hour period on the same day of the week for the last four weeks.

[timroes]

You can already today specify the background set, using the "JSON input" under "Advanced Setting" in the significant terms aggregation, by specifying { "background_filter": <any ES query> } (see also Significant Terms aggregation docs.

[red-knight]

Ah, hah. I must have made a formatting mistaken when I tried it, then.

Thanks, and enjoy your articles.

[stratoula]

Thank you for contributing to this issue, however, we are closing this issue due to inactivity as part of a backlog grooming effort. If you believe this feature/bug should still be considered, please reopen with a comment.