I'm trying to understand how to create an aggregation query for tag distribution.

Record example:

 @timestamp: {iso time} ,
 record_type: {string},
 record_data: {string},
 tags: [ {key: {string}, value: {string}}, ...]

I want to query the data and get a distribution of tags (key, value) over a specific record type.
Example of response:

       {key: "key1",
        value: "value1",
        count: 2
       {key: "key2",
        value: "value2",
        count: 1

I'm not sure which aggregation pipeline should I use?

if tags field is mapped as nested type, then you need to check the bellow link