es agg like https://twitter.com/OzzyCzech/status/585066653790109696

elasticsearch.php

<?php

$q = [
    "query" => ["filtered" => [
        "filter" => ["range" => [
            "created" => ["gte" => "-31 days"],
        ]],
    ]],
    "aggs" => [
        "by_date" => ["date_histogram" => [
            "field" => "created",
            "interval" => "1d",
            "aggs" => [
                "by_severity" => ["filters" => [
                    "filters" => [
                        "error" => ["term" => ["severity" => 1]],
                        "warning" => ["term" => ["severity" => 2]],
                        // no need for total, by_date buckets already have doc_count == total
                        // "total" => ["match_all" => []],
                    ],
                ]],
            ],
        ]]
    ]
];

sample.sql

SELECT
    DATE(created),
    COUNT(*) total,
    SUM(IF(severity = 1, 1, 0)) errors,
    SUM(IF(severity = 2, 1, 0)) warnings
FROM t
WHERE created >= NOW()-INTERVAL 31 DAY
GROUP BY DATE(created)