我编写了一个查询，它可以完美地返回用户拥有6000多个事件：

GET /<app_logs-2022.11.23*>/_search
{
  "query": { 
    "bool": {
      "should": [
        {
          "term": {
            "context.identity.type": "login"
          }
        },
        {
          "term": {
            "context.identity.type": "login_error"
          }
        }
      ],
      "minimum_should_match": 1
    }
  },
  "_source": [
    "context.identity.user_id",
    "context.identity.type"
  ],
  "size": 3
}

我得到了这样一组数据

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 15,
    "successful" : 15,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 6001,
    "max_score" : 10.722837,
    "hits" : [
      {
        "_index" : "app_logs-2022.11.23-7",
        "_type" : "app",
        "_id" : "bb469377-0618-49a6-a643-1201dc84c829",
        "_score" : 10.722837,
        "_source" : {
          "context" : {
            "identity" : {
              "user_id" : "72562ad0-4f35-4624-8776-8b555dea851e",
              "type" : "login"
            }
          }
        }
      },
      {
        "_index" : "app_logs-2022.11.23-7",
        "_type" : "app",
        "_id" : "8f4e82a0-f333-4096-bfb6-767fed924093",
        "_score" : 10.722837,
        "_source" : {
          "context" : {
            "identity" : {
              "user_id" : "72562ad0-4f35-4624-8776-8b555dea851e",
              "type" : "login_error"
            }
          }
        }
      },
      {
        "_index" : "app_logs-2022.11.23-7",
        "_type" : "app",
        "_id" : "7090be5a-8b53-4723-a1ac-223476a000f1",
        "_score" : 10.722837,
        "_source" : {
          "context" : {
            "identity" : {
              "user_id" : "75bcb301-1cee-4b3b-aa1b-adbe4c011388",
              "type" : "login_error"
            }
          }
        }
      }
    ]
  }
}

但是我不知道如何获得同时有login和login_error事件的用户数量，我已经尝试了cardinality聚合、terms和其他几个，但它们都只是将类型拆分到显示总和的桶中，而不是按用户分组，我想找出有多少用户首先出现问题，但最后成功登录。
我所做的最好的工作是按user_id获取bucket，并按类型输出每个bucket的基数

"aggs": {
    "results": {
      "terms": {
        "field": "context.identity.user_id",
        "size": 300
      },
      "aggs": {
        "events": {
          "cardinality": {
            "field": "context.identity.type"
          }
        }
      }
    }
  }