query the event log for signs of flapping

dev-console-el-flapping-aggs.txt

POST .kibana-event-log-8.5.0/_search
{
  "size": 0,
  "query": {
    "bool" : {
      "must" : {
        "range": { "@timestamp": { "gte": "now-18s" }}
      },
      "filter": {
        "terms" : { "event.action" : ["new-instance", "active-instance", "recovered-instance"] }
      }
    }
  },
  "aggs": {
    "alerts": {
      "terms": { "field": "kibana.alerting.instance_id" },
      "aggs": {
        "counts": {
          "terms": { "field": "event.action" }
        }
      }
    }
  }  
}