Sorry, not sure I follow. I believe that if I filter on 'Left' doesn't exist then it would still only show within the interval in which the document was indexed or timestamp applies, not subsequent buckets until they have left?
I've found this article but not having any luck trying to convert to Painless at the moment: -
https://discuss.elastic.co/t/display-concurrency-in-data-on-kibana/26006