I ran a terms aggregation and got back a bunch of buckets with keys and doc_counts. I want to treat the doc_counts from all the buckets returned as the input for a histogram aggregation (treat the doc_counts as a set). This is for analysis of API logs to determine how many different clients (IP addresses) use the API on a daily basis. So I would like to end up with data that would tell me 800 clients make 0-100 hits, 900 clients make 100-200 hits, etc.
How can this be accomplished? Would this be a sub-aggregation? Pipeline? Nested?
TL;DR: How to apply a histogram aggregation from the results of a terms aggregation (using the doc_counts as a set for input into the histogram aggregation.
Thank you!