Use doc_count as cumulative count

You're on the right path with the cumulative sum aggregation and you can definitely use it. You just need to use the special _count bucket path and that will do the job you expect.

{  "size": 0,  "query": {    "type": {      "value": "user"    }  },  "aggs": {    "users_per_day": {      "date_histogram": {        "field": "createdAt",        "interval": "day"      },      "aggs": {        "cumulative": {          "cumulative_sum": {            "buckets_path": "_count"          }        }      }    }  }}

The results will look like this:

[{  "key_as_string": "1450909920",  "key": 1450909920000,  "doc_count": 8,  "cumulative": {"value": 8}},{  "key_as_string": "1450909980",  "key": 1450909980000,  "doc_count": 2,  "cumulative": {"value": 10}},{  "key_as_string": "1450910040",  "key": 1450910040000,  "doc_count": 5,  "cumulative": {"value": 15}},{  "key_as_string": "1450910100",  "key": 1450910100000,  "doc_count": 8,  "cumulative": {"value": 23}},{  "key_as_string": "1450910160",  "key": 1450910160000,  "doc_count": 4,  "cumulative": {"value": 27}},{  "key_as_string": "1450910220",  "key": 1450910220000,  "doc_count": 3,  "cumulative": {"value": 30}},{  "key_as_string": "1450910280",  "key": 1450910280000,  "doc_count": 6,  "cumulative": {"value": 36}}]