Hello,
in elasticsearch I store user events. Such as email sent, email opened, user signed in. Each event is represented by one entry (document) in ES ({...,"action":"EMAIL_SENT",...}
). Is it possible to query e.g. all users that opened email and then logged in? In other worlds there is sequence of following events in index (ordered by time):
{"userId":1, "action":"EMAIL_SENT",...}
{"userId":2, "action":"SOME_ACTION",...}
{"userId":1, "action":"LOG_IN",...}
and query should find user with userId: 1
. Can it be done using only one index? I don't want to merge results of two queries programatically as it may be spatially inefficient.
Thanks for suggestions