Sure, I attached all the code below. Thank you!
```
{
"$schema": "https://vega.github.io/schema/vega-lite/v2.json"
"data": {
"url": {
"%timefield%": "@timestamp"
"%context%": "true"
"index": "/events-*"
"body": {
"size": 0,
"aggs": {
"users": {
"terms": {
"field": "userID",
"size": 10000,
"order" : {"eventCount": "desc"}
},
"aggs": {
"eventCount": {
"cardinality": {
"field": "deviceID"}
}
}
}
}
}
}
"format": {"property": "aggregations.users.buckets"}
}
"mark": "bar"
"transform": [
{
"aggregate": [
{"op": "count", "field": "key", "as": "usercount"}
]
"groupby": ["eventCount.value"]
}
]
"encoding": {
"x": { "field": "eventCount\\.value", "type": "ordinal", "sort": "descending" }
"y": { "field": "usercount", "type": "quantitative" }
}