Query,aggregation and buckets

Hi all.
I need a bit of help regarding aggregations and buckets to create visualizations and dashboards.

I have metricbeat running on a kubernetes cluster and I need to create alerts in case some pods go down.

Not sure how to do it cause I need to check first if the desired replicas are metching the runnings ones then in case they are not trigger the alerts.

Any idea or specific docs are appreciated.
Cheers

@alfredo.deluca you can check out all the docs here: https://github.com/opendistro-for-elasticsearch/sql#documentation