Getting total count based on collapsed value

Elastic Stack Elasticsearch
1

I am new to elastic search and i am trying to extract total number of concurrent users active in the given period.

For example i have a data as below

User Login Time Logout Time
A 2020-09-21T10:00:00 2020-09-21T10:30:00
B 2020-09-21T10:00:10 2020-09-21T10:30:15
C 2020-09-21T10:00:08 2020-09-21T10:30:10
D 2020-09-21T10:00:15 2020-09-21T10:30:03

From the above data i want to build below result

Time stamp Concurrent Users
2020-09-21T10:00:00 1
2020-09-21T10:00:08 2
2020-09-21T10:00:10 3
2020-09-21T10:00:15 4
2020-09-21T10:30:00 4
2020-09-21T10:30:03 3
2020-09-21T10:30:10 2
2020-09-21T10:30:15 1

My understanding is we can do this in two steps

  1. Extract unique login and logout time
  2. _count the value based on filter (logout time lte given time, login time gte given time)

I would like to know is it possible to extract the result in single query?
I am working in version 7.9.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.