In this example we want to get the top ten terminating rule ids. We need to monitor terminatingRuleId

For Log format, choose JSON.
Under Contribution→ keys, enter a contributor type enter terminatingRuleId
For Aggregation → Aggregate on, choose COUNT.