I think I figure out the proper way to do it. Thanks Mark for pointing out the 1 day condition in my query:
{
"query": { "term": { "username": { "value": "guest@bdtt" } } },
"aggs": {
"sessions": {
"terms" : { "field" : "callingstationid" },
"aggs": {
"total_minute": {
"sum": {"script":"doc['acctstoptime'].date.getMillis() - doc['acctstarttime'].date.getMillis()"}
},
"count_starttime": {
"cardinality" :
{"script":"doc['acctstarttime'].date.dayOfMonth"}
}
}
}
}
}