Cardinality over Date Histogram
We faced the same issue in our code and our solution was to use a Terms Aggregation on the UserId Field with a nested Min Aggregation on the datetime field. This provides you with a bucket for each userId containing the Bucket with the first visit. We do this aggregation outside of the date histogram and map it manually afterwards.
"aggs": {
"UniqueUsers": {
"terms": {
"field": "userId",
"size": 1000,
}, "aggs": {
"FirstSeen": {
"min": {
"field": "date"
}
}
}
}
}
This works for us, but i am sure there should be a better implementation.