Consulta SQL no ELASTIC

sql-elastic-sample.bash

POST /_sql?format=txt
{
  "query": """
  SELECT payload_parsed.externalId, COUNT(*) as ocurrences FROM "TABLE"  // "TABLE*"
  WHERE payload_parsed.type.keyword = 'MESSAGE_STATUS'
  AND event_data.source.keyword = 'ZENVIA'
  AND payload_parsed.channel.keyword = 'email'
  AND payload_parsed.messageStatus.code.keyword = 'SENT'
  AND inserted_date >= NOW() - INTERVAL 48 HOUR 
  GROUP BY payload_parsed.externalId HAVING COUNT(*) > 2
  """
}