Here you give Elasticsearch template: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/app/elasticsearch_http/template_app_elasticsearch_http.yaml

Look at formula for key `es.node.indices.flush.latency{#ES.NODE}`:

last(es.node.indices.flush.total_time_in_millis[{#ES.NODE}]) / ( last(es.node.indices.flush.total[{#ES.NODE}]) + (last(es.node.indices.flush.total[{#ES.NODE}]) = 0) ) 

More accurate formula should be:

 
(not (change(es.node.indices.flush.total_time_in_millis[{#ES.NODE}]) < 0)) * ( change(es.node.indices.flush.total_time_in_millis{#ES.NODE}) / ( change(es.node.indices.flush.total[{#ES.NODE}]) + (last(es.node.indices.flush.total{#ES.NODE}) = 0) ) ) 

You divide total time spent for operation from server start on total count of operation from server start. So if our server for several days made operation in 100ms, but now it become slow and is making operations in 1000ms - we will see that only after long period of time, when we make lot of slow operations.

The accurate formula should be (if simplified): `change(total_time_in_millis) / change(total)`. We should look on latency just for new operations, not all history.