For the first one, it pretty much depends on how you have your events indexed in ES. If you just ingest events with a timestamp then it's going to be a bit weird. But if you ingest them as {user, timeEventA, timeEventB} this could be done.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.