How do I use doc_count in an aggregations range query in ElasticSearch 1.0

Question

I have a bunch of user generated events in my ES cluster. Each event contains the user's UUID.

I'm trying to write a query that buckets users into low, medium and high activity based on the number of events each user generates.

I'm using this query to get the number of events generated by each user:

{
    "aggs" : {
        "users" : { 
            "terms" : { "field" : "user_id.raw" }
         }
    }
}

This works fine, but I need to further bucket the results into a range query using the previous results "doc_count", so that I can sort each user into a low, med, high activity bucket.

I tried a bunch of ways to access the doc_count field using a sub-aggregation but never manage to get it work. I figured this would be a fairly common use case, but can't seem to crack it, so any help would be much appreciated.

Answer 1

I have updated https://github.com/elasticsearch/elasticsearch/issues/4983?_pjax=%23js-repo-pjax-container with this issue as well.

Looks like a minor enhancement to the aggregation framework (but) will be really useful.