Number of nested objects in Elasticsearch

Looking for a way to get the number of nested objects, for querying, sorting etc.
For example, given this index:

PUT my-index-000001
{
  "mappings": {
    "properties": {
      "some_id": {"type": "long"},
      "user": {
        "type": "nested",
        "properties": {
          "first": {
            "type": "keyword"
          },
          "last": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

PUT my-index-000001/_doc/1
{
  "some_id": 111,
  "user" : [
    {
      "first" : "John",
      "last" :  "Smith"
    },
    {
      "first" : "Alice",
      "last" :  "White"
    }
  ]
}

How to filter by the number of users (e.g. query fetching all documents with more than XX users).

I was thinking to using a runtime_field but this gives an error:

GET my-index-000001/_search
{
  "runtime_mappings": {
    "num": {
      "type": "long",
      "script": {
        "source": "emit(doc['some_id'].value)"
      }
    },
    "num1": {
      "type": "long",
      "script": {
        "source": "emit(doc['user'].size())" // <- this breaks with "No field found for [user] in mapping"
      }
    }
  }
  ,"fields": [
    "num","num1"
  ]
}

Is it possible perhaps using aggregations?

Would also be nice to know if I can sort the results (e.g. all documents with more than XX and sorted desc by XX).

Thanks.

You cannot query this efficiently

It is possible to use this hack for it, but I would only do it if you need to do some one-time fetching, not for a regular use case as it uses params._source and is therefore really slow when you have a lot of docs

{
  "query": {
    "function_score": {
      "min_score": 1,  # -> min number of nested docs to filter by
      "query": {
        "match_all": {}
      },
      "functions": [
        {
          "script_score": {
            "script": "params._source['user'].size()"
          }
        }
      ],
      "boost_mode": "replace"
    }
  }
}

It basically calculates a new score for each doc, where the score is equal to the length of the users array, and then removes all docs under min_score from returning

The best way to do this is to add a userCount field at indexing time (since you know how many elements there are) and then query that field using a range query. Very simple, efficient and fast.

Each element of the nested array is a document in itself, and thus, not queryable via the root-level document.

If you cannot re-create your index, you can leverage the _update_by_query endpoint in order to add that field:

POST my-index-000001/_update_by_query?wait_for_completion=false
{
  "script": {
    "source": """
     ctx._source.userCount = ctx._source.user.size()
    """
  }
}