# Is there a way to search for the document when the user\_id first appeared?

**URL:** <https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434>\
**Category:** Elasticsearch\
**Created:** [August 19, 2016, 9:15am UTC](https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434 "2016-08-19T09:15:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)\
**Post date:** [August 19, 2016, 9:15am UTC](https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434/1 "2016-08-19T09:15:32Z")

</div>

Hi  
I have an index recording nginx logs, one log-line matches one es document.

I'd like to know if there is a way to search for the the document when the user\_id first appeared.

To be clear, I'm not asking how to find the document of one specified user\_id, but all user\_ids.

```auto
# not like this!
{
  "size": 1,
  "sort": [
    {
      "@timestamp": {
        "order": "asc"
      }
    }
  ],
  "query": {
    "match": {
      "user_id": "xxxxxx"
    }
  }
}

```

In other words, I need some filter to search for the first appearance documents distinct by user\_id, and then do some aggregations on this sub-records.

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [August 19, 2016, 9:17am UTC](https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434/2 "2016-08-19T09:17:56Z")

</div>

This is not possible.

---

<div class="post-metadata">

**Author:** ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)\
**Post date:** [August 19, 2016, 9:37am UTC](https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434/3 "2016-08-19T09:37:26Z")

</div>

Even with the groovy script?

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [August 19, 2016, 9:39am UTC](https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434/4 "2016-08-19T09:39:42Z")

</div>

Your best option today would be to run a `terms` aggregation on user\_id with a sum `top_hits` aggregation that sorts by timestamp, but this won't scale well since `user_id` has a high cardinality I suppose.

---

<div class="post-metadata">

**Author:** ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)\
**Post date:** [August 19, 2016, 10:33am UTC](https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434/5 "2016-08-19T10:33:48Z")

</div>

And it seemed that neither can I do a furthermore pipeline aggregation on top\_hits aggregations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:26pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-search-for-the-document-when-the-user-id-first-appeared/58434/6 "2017-07-05T22:26:40Z")

</div>