I'm trying to figure out how to group by a count coming out of another aggregation. Let's say I have data that has events about users, with user_id as one of the fields. For example, it could look like this
user_id = user1
user_id = user1
user_id = user2
user_id = user3
user_id = user3
user_id = user3
user_id = user4
user_id = user5
I want the count of how many user_id's occur exactly 1, 2, 3, ... etc times in the list. In this case, the result would be:
1=>3 (user2, user4, user5)
2=>1 (user1)
3=>1 (user3)
I just need the counts, not who those users are.
I can get to the point of counting the number of occurrences of each user_id by using term aggregation. From there, I tried another term aggregation on doc_count or _count of the first aggregation, but it doesn't seem to work. I was not able to find clear documentation on the syntax for that, so that may be my problem.
Please let me know if anyone has a solution.
Thanks!
Andrey