added "missing" bucket in aggregation, fixed user mapping