Elasticsearch : Getting total count based on collapsed value - elasticsearch

Question

I am new to Elasticsearch and I am trying to extract total number of concurrent users active in the given period.
For example, I have a data set as below:
User Login Time Logout Time
A 2020-09-21T10:00:00 2020-09-21T10:30:00
B 2020-09-21T10:00:10 2020-09-21T10:30:15
C 2020-09-21T10:00:08 2020-09-21T10:30:10
D 2020-09-21T10:00:15 2020-09-21T10:30:03
From the above data I want to build below result:
Timestamp Concurrent Users
2020-09-21T10:00:00 1
2020-09-21T10:00:08 2
2020-09-21T10:00:10 3
2020-09-21T10:00:15 4
2020-09-21T10:30:00 4
2020-09-21T10:30:03 3
2020-09-21T10:30:10 2
2020-09-21T10:30:15 1
My understanding is we can do this in two steps
Extract unique login and logout time
_count the value based on filter (logout time lte given time, login time gte given time)
I would like to know is it possible to extract the result in single query?
I am working in version 7.9.

Answer 1

You can probably do this by setting a new field "session" as a date_range
with gte: logintime et lte: logouttime
Then you will be able to do a date_histogramm.
Please find below a small test case:
PUT test/_mapping
{
"properties": {
"date_range_test": {
"type": "date_range"
}
}
}
POST test/_doc
{
"title": "test1",
"date_range_test": {
"gte": "2020-01-01",
"lte": "2020-01-05"
}
}
POST test/_doc
{
"title": "test1",
"date_range_test": {
"gte": "2020-01-02",
"lte": "2020-01-05"
}
}
POST test/_doc
{
"title": "test2",
"date_range_test": {
"gte": "2020-01-02",
"lte": "2020-01-07"
}
}
POST test/_doc
{
"title": "test3",
"date_range_test": {
"gte": "2020-01-07",
"lte": "2020-01-08"
}
}
GET test/_search
{
"size": 0,
"aggs": {
"sessions": {
"date_histogram": {
"field": "date_range_test",
"fixed_interval": "1d"
}
}
}
}
And the response
{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 5,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"sessions" : {
"buckets" : [
{
"key_as_string" : "2020-01-01T00:00:00.000Z",
"key" : 1577836800000,
"doc_count" : 1
},
{
"key_as_string" : "2020-01-02T00:00:00.000Z",
"key" : 1577923200000,
"doc_count" : 3
},
{
"key_as_string" : "2020-01-03T00:00:00.000Z",
"key" : 1578009600000,
"doc_count" : 3
},
{
"key_as_string" : "2020-01-04T00:00:00.000Z",
"key" : 1578096000000,
"doc_count" : 3
},
{
"key_as_string" : "2020-01-05T00:00:00.000Z",
"key" : 1578182400000,
"doc_count" : 3
},
{
"key_as_string" : "2020-01-06T00:00:00.000Z",
"key" : 1578268800000,
"doc_count" : 1
},
{
"key_as_string" : "2020-01-07T00:00:00.000Z",
"key" : 1578355200000,
"doc_count" : 2
},
{
"key_as_string" : "2020-01-08T00:00:00.000Z",
"key" : 1578441600000,
"doc_count" : 1
}
]
}
}
}