The documentation says that distinct count is an approximation: I still struggle why two queries, one detail the other one an aggregation don’t reconcile. I am expecting the rvt_file_count = 3.
I even tried to nest the queries with no success. Am I simply using the wrong tool? i.e. I shouldn’t be using ES|QL in the first place. Thanks in advance for any insight…