I want to get the counts of nested groups which satisfy a certain condition.
Consider the following type of documents:
{
user-id: "abc"
session-id: "abc-123"
action: "A123"
}
I want to show the count of a specific "action" on a timeline if there a given "user-id" that has at least 2 distinct "session-id"s. The purpose is to tell, how many returning user ( session-ids >= 2 ) triggered a specific action ( action = "A123" ) on Mon., Thu., Wed...
In elastic terms I probably try to do the following:
- create a bucket for each "user-id"
- consider only buckets having at least 2 distinct "session-ids" vs. consider only buckets having exactly 1 distinct "session-ids".
- consider only buckets having a least one document matching (action: "A123")
- the aggregate count of remaining documents in a time-histogram
I read through elastic aggregations and pipelines but did not come to a solution in Kibana 6.2 yet. Yould you please point me in a direction? Any hints and ideas are highly appreciated.