Finding the count of unique elements can be done with the cardinality aggregation. It is similar to finding the result of a query such as the following:

select count(*) from (select distinct username from usageReport) u;

Finding the cardinality, or the number of unique values, for a specific field is a very common requirement. If you have a click stream from the different visitors on your website, you may want to find out how many unique visitors you had in a given day, week, or month.

Let's look at how we can find out the count of unique users for which we have network traffic data:

GET bigginsight/_search
{
 "aggregations": {
    "unique_visitors": {
      "cardinality": {
        "field": "username"
      }
    }
  },
  "size": 0
}

The cardinality aggregation response is just like the other metric aggregations:

{
  "took": 110,
  ...,
  "hits": {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "unique_visitors": {
      "value": 79
    }
  }
}

Now that we have covered the simplest forms of aggregations, we can look at some of the bucket aggregations.