{
  "_comment": "Measure ingest rate on a Wazuh 5.0 indexer. Run against wazuh-events-v5-* (normalised events), NOT wazuh-findings-v5-*: a finding only exists when a rule matched, so counting findings measures detection output, not ingest rate. Divide each per_minute bucket by 60 for EPS. Paste the body below into Indexer management > Dev Tools with: GET /wazuh-events-v5-*/_search",
  "size": 0,
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-1h",
        "lt": "now"
      }
    }
  },
  "aggs": {
    "per_minute": {
      "date_histogram": {
        "field": "@timestamp",
        "fixed_interval": "1m"
      }
    },
    "by_agent": {
      "terms": {
        "field": "wazuh.agent.name",
        "size": 20,
        "order": { "_count": "desc" }
      }
    },
    "by_integration_category": {
      "terms": {
        "field": "wazuh.integration.name",
        "size": 20,
        "order": { "_count": "desc" }
      }
    }
  }
}