title: Can Kibana visualizations aggregate by a meta field such as _size?
body: <p>I'd like to visualize how our average elasticsearch document size is changing over time.</p>
  
  <ol>
  <li>We use ElasticSearch v7.1. We use the AWS ElasticSearch service and the <a href="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-supported-plugins.html" rel="nofollow noreferrer">Mapper Size Plugin is installed</a>.</li>
  <li>I enabled the <code>_size</code> field on my index. <a href="https://www.elastic.co/guide/en/elasticsearch/plugins/current/mapper-size-usage.html" rel="nofollow noreferrer">ref</a></li>
  <li>In Kibana "Discover" I can find small documents using: <code>_size: &lt;900</code>
  
  <ul>
  <li>Or I can query from the command line: <code>curl -H 'Content-Type: application/json' -s http://es.example.com/logstash-2019.10.17/_search -d '{"query": {"range": {"_size": { "lt": 900 }}}}' | jq .</code></li>
  </ul></li>
  </ol>
  
  <p>Now I want to create a Kibana visualization, for example a date histogram with the median <code>_size</code>, <strong>but Kibana "<em>Visualize</em>" won't let me select <code>_size</code> as the aggregation field</strong>. Is there a way to visualize the size of documents?</p>
  
  <hr>
  
  <p>_size is a "<a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-fields.html" rel="nofollow noreferrer">meta-field</a>".</p>
  
  <blockquote>
    <p><code>_size</code>
    The size of the <code>_source</code> field in bytes, provided by the <a href="https://www.elastic.co/guide/en/elasticsearch/plugins/7.4/mapper-size.html" rel="nofollow noreferrer">mapper-size plugin</a>.</p>
  </blockquote>
  
  <p>Maybe "meta fields" aren't supported in Kibana?</p>
  
  <p>I can aggregate by <code>_size</code> when not using Kibana "Visualize":</p>
  
  <pre><code>curl -H 'Content-Type: application/json' -s http://es.example.com/logstash-2019.10.17/_search -d '{
    "query": {
      "range": {
        "_size": {
          "gt": 10
        }
      }
    },
    "aggs": {
      "sizes": {
        "terms": {
          "field": "_size",
          "size": 10
        }
      }
    },
    "sort": [
      {
        "_size": {
          "order": "desc"
        }
      }
    ]
  }' | jq .
  </code></pre>