List the active users using login and logged out events

Elastic Stack Elasticsearch
6

I can think of several:

  1. Aggs solution - terms agg to group by session ID and sub aggs to gather related login/out events
  2. Stream solution - use scroll api sorted on session ID
  3. Active users index - create doc with session ID on login, delete on logout
  4. Entity-centric index to track active sessions, durations and more.

Solution 1 is not scalable with large numbers of users and is needlessly bogged-down with historical inactive sessions.
Solution 2 is scalable but slow and requires custom querying code
Solution 3 requires custom indexing code but is easy to query
Solution 4 requires custom scripts (examples available) but offers greater potential insights into sessions.