Using cardinality on a field after bucketing


I have an index of user events and I want to calculate the number of active users. Counting the number of users with at least 1 event in the last 30 days is easy, but I would like to count users with events on multiple days.

If I bucket by user and run cardinality on the 'date' field, this should count the number of unique days on which a user has logged events. So users with 1+ events on a single day would be 1, whereas users with 2+ events spread over multiple days would have >1. Then I can just filter out the users who only have a 1.

I am not really sure how to do this in ES, or if it's possible. Any help would be appreciated.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.