How to get elasticsearch data per day per namespace

Hello,

I would like to know if there is a method / query to get some idea about how much data is getting sent to elasticsearch in a breakdown per day by each namespace, in OpenShift 4 (4.10)

There is a built-in dashboard "Documents per Namespace trend" and the query behind it seems to be "sum by (exported_namespace) (es_index_document_count{cluster="elasticsearch"})". Looking at the visualization, I don't think this is what I'm after.

Basically, the requirement is to identify the increase of number of events in a namespace when an app is run in debug mode vs. normal over a period of time.

Appreciate any suggestions.