http://localhost:5601/app/sense

parent-child-filter-aggregation-query

POST bam
{
  "mappings": {
    "events": {
      "_parent": {
        "type": "users"
      },
      "properties": {
        "created_at": {
          "type": "date",
          "format": "dateOptionalTime"
        },
        "label": {
          "type": "string",
          "index": "not_analyzed"
        },
        "action": {
          "type": "string",
          "index": "not_analyzed"
        },
        "user_id": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    },
    "users": {
      "properties": {
        "name": {
          "type": "string",
          "index": "not_analyzed"
        },
        "email": {
          "type": "string",
          "index": "not_analyzed"
        },
        "industry": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}

PUT bam/events/_bulk
{ "create": { "parent": "123" } }
{ "created_at": "2016-07-15T15:29:50+10:00", "label": "Page 1", "action": "view", "user_id": "123"}
{ "create": { "parent": "123" } }
{ "created_at": "2016-07-15T15:30:50+10:00", "label": "Page 2", "action": "view", "user_id": "123"}
{ "create": { "parent": "123" } }
{ "created_at": "2016-07-15T15:32:50+10:00", "label": "Page 3", "action": "view", "user_id": "123"}
{ "create": { "parent": "123" } }
{ "created_at": "2016-07-15T15:33:10+10:00", "label": "Page 4", "action": "view", "user_id": "123"}
{ "create": { "parent": "123" } }
{ "created_at": "2016-07-16T15:29:50+10:00", "label": "Page 5", "action": "view", "user_id": "123"}
{ "create": { "parent": "125" } }
{ "created_at": "2016-07-15T15:29:40+10:00", "label": "Page 5", "action": "view", "user_id": "125"}
{ "create": { "parent": "125" } }
{ "created_at": "2016-07-15T15:29:55+10:00", "label": "Page 5", "action": "view", "user_id": "125"}
{ "create": { "parent": "125" } }
{ "created_at": "2017-07-15T15:29:55+10:00", "label": "Page 5", "action": "view", "user_id": "125"}

PUT bam/users/125
{
  "name": "Smith",
  "email": "[email protected]",
  "industry": "Software"
}

PUT bam/users/123
{
  "name": "Adam",
  "email": "[email protected]",
  "industry": "IT"
}

GET bam/events/_search
{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "created_at": {
                  "gte": "2016-07-15T15:40:55+10:00"
                }
              }
            }
          ]
        }
      }
    }
  }
}

GET bam/users/_search
{
  "aggs": {
    "by_industry": {
      "terms": {
        "field": "industry",
        "size": 10
      },
      "aggs": {
        "events": {
          "children": {
            "type": "events"
          },
          "aggs": {
            "by_user_id": {
              "filter": {
                "bool": {
                  "must": [
                    {
                      "range": {
                        "created_at": {
                          "gte": "2016-07-15T15:40:55+10:00"
                        }
                      }
                    }
                  ]
                }
              },
              "aggs": {
                "filterd_by_user_id": {
                  "terms": {
                    "field": "user_id",
                    "size": 10
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0
}

parent-child-filter-aggregation-result

# result from GET bam/events/_search
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "bam",
        "_type": "events",
        "_id": "AVpkQJizDuzxzVpPu3OV",
        "_score": 1,
        "_source": {
          "created_at": "2017-07-15T15:29:55+10:00",
          "label": "Page 5",
          "action": "view",
          "user_id": "125"
        }
      },
      {
        "_index": "bam",
        "_type": "events",
        "_id": "AVpkQJizDuzxzVpPu3OS",
        "_score": 1,
        "_source": {
          "created_at": "2016-07-16T15:29:50+10:00",
          "label": "Page 5",
          "action": "view",
          "user_id": "123"
        }
      }
    ]
  }
}

# result from GET bam/users/_search
{
  "took": 2,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "by_industry": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "IT",
          "doc_count": 1,
          "events": {
            "doc_count": 5,
            "by_user_id": {
              "doc_count": 5,
              "filterd_by_user_id": {
                "doc_count_error_upper_bound": 0,
                "sum_other_doc_count": 0,
                "buckets": [
                  {
                    "key": "123",
                    "doc_count": 5
                  }
                ]
              }
            }
          }
        },
        {
          "key": "Software",
          "doc_count": 1,
          "events": {
            "doc_count": 3,
            "by_user_id": {
              "doc_count": 3,
              "filterd_by_user_id": {
                "doc_count_error_upper_bound": 0,
                "sum_other_doc_count": 0,
                "buckets": [
                  {
                    "key": "125",
                    "doc_count": 3
                  }
                ]
              }
            }
          }
        }
      ]
    }
  }
}