{
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "title": "Pareto: status_code",
  "data": {
    "url": {
      "%context%": true,
      "%timefield%": "@timestamp",
      "index": "logs-*",
      "body": {
        "size": 0,
        "aggs": {
          "codes": {
            "terms": {
              "field": "status_code",
              "size": 50,
              "order": { "_count": "desc" }
            }
          }
        }
      }
    },
    "format": { "property": "aggregations.codes.buckets" }
  },

  "transform": [
    { "calculate": "datum.doc_count", "as": "count" },

    {
      "window": [
        { "op": "sum", "field": "count", "as": "cumulative" }
      ],
      "sort": [{ "field": "count", "order": "descending" }]
    },

    {
      "joinaggregate": [
        { "op": "sum", "field": "count", "as": "total" }
      ]
    },

    {
      "calculate": "datum.cumulative / datum.total * 100",
      "as": "cum_percent"
    }
  ],

  "encoding": {
    "x": {
      "field": "key",
      "type": "nominal",
      "title": "Status code",
      "sort": null
    }
  },

  "layer": [
    {
      "mark": "bar",
      "encoding": {
        "y": {
          "field": "count",
          "type": "quantitative",
          "title": "Count"
        }
      }
    },

    {
      "mark": { "type": "line", "color": "red", "point": true },
      "encoding": {
        "y": {
          "field": "cum_percent",
          "type": "quantitative",
          "title": "Cumulative %",
          "axis": { "grid": false }
        }
      }
    }
  ],

  "resolve": { "scale": { "y": "independent" } }
}