Support a keyed histogram

[danielmitterdorfer]

Description

Given documents with the following structure (note that the event_ids property can contain duplicate keys which must be considered in the aggregation):

{
  "id": "f7c173cdb16c743d",
  "event_ids": ["a", "b", "c", "a", "a"]
},
{
  "id": "a82173cdb16cbba7",
  "event_ids": ["d", "a", "b", "b", "a"]
}

we'd like to be able to aggregate the data as follows:

[
  {
    "key": "a",
    "count": 5
  },
  {
    "key": "b",
    "count": 3
  },
  {
    "key": "c",
    "count": 1
  },
  {
    "key": "d",
    "count": 1
  }
]

You could essentially call this a "keyed histogram".

Note that there is some flexibility in how the event_ids property should look like. For example, the following structure would also be possible (the example is limited to the event_ids property of the first document above):

[
  {
    "key": "a",
    "count": 3
  },
  {
    "key": "b",
    "count": 1
  },
  {
    "key": "c",
    "count": 1
  }
]

Note: This is somewhat related to the idea presented in #61550 (comment).

/cc: @martijnvg

[elasticsearchmachine]

Pinging @elastic/es-analytics-geo (Team:Analytics)

[danielmitterdorfer]

@martijnvg came up with the idea to add add a dedicated field type which encodes the values in a way to keep track of duplicates (this will make the format less efficient). The new field mapper type will be similar to a keyword field but maintains two doc values fields: one for the values and one for the number of occurrences. (which often will be 1, but for duplicates by > 1). The field data instance returned by this field should use the occurrence doc values field to emit the duplicates, so aggregations can take duplicated values into account.

With this new field type in place, we can then just use the terms aggregation to retrieve data in the desired format.