Aggregations on multivalued fields

Elastic Stack Elasticsearch
1

I have an index with the following fields:

user-ids : multivalued field

timestamp : date field

"user": [
"w@c.com",
"d@s.edu",
"a@s.org"
],
"timestamp": 967568760000

Each document represents one login attempt at the given timestamp by the list of users, and each user appears only once in the user list.

I want to write a query to get
how many logins did each user attempt each day.
I am trying to use date_histogram but cannot figure out how to pivot it on user.

2

I don't think you can in core ES, you'd want to split those into individual records.

Otherwise, something like graph might be able to do it.