Using cardinality on a field after bucketing

Elastic Stack Elasticsearch
1

Hi,

I have an index of user events and I want to calculate the number of active users. Counting the number of users with at least 1 event in the last 30 days is easy, but I would like to count users with events on multiple days.

If I bucket by user and run cardinality on the 'date' field, this should count the number of unique days on which a user has logged events. So users with 1+ events on a single day would be 1, whereas users with 2+ events spread over multiple days would have >1. Then I can just filter out the users who only have a 1.

I am not really sure how to do this in ES, or if it's possible. Any help would be appreciated.

Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.