Every entry in the document has a username, starttimeISO and uuid (which is not starttimeiso)
So every record has a starttimeISO which is the time when the username was seen. The document looks like this: { Uuid: xxx StartTimeISO: 2015-01-18T00:00:00.000Z Username: abc } There are multiple records in the document. Indexing is applied on "username" and "starttimeiso" fields.