For the first one, it pretty much depends on how you have your events indexed in ES. If you just ingest events with a timestamp then it's going to be a bit weird. But if you ingest them as {user, timeEventA, timeEventB} this could be done.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.