Get Users With More Than One Account in the Same Source

[colin_mckibben]

The query above will only work when limiting by authoritative source. The reason for this is that the top level source object on an identity object is that identity’s authoritative source. If you need to restrict your query to a non-authoritative source, then you will need to use the following query.

{
    "query": {
        "query": "@accounts(source.id:2c918088814e6a610181686b56977fa8)"
    },
    "indices": [
        "identities"
    ],
    "aggregationsDsl": {
        "accounts": {
            "nested": {
                "path": "accounts"
            },
            "aggs": {
                "source_id": {
                    "terms": {
                        "field": "accounts.source.id",
                        "min_doc_count": 2,
                        "size": 1000
                    },
                    "aggs": {
                        "identities": {
                            "terms": {
                                "field": "_id",
                                "min_doc_count": 2
                            },
                            "aggs": {
                                "accounts": {
                                    "top_hits": {}
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

There are many other ways to narrow down your search, as documented in the searchable fields guide.