Date_histogram returning wrong number of buckets

Elastic Stack Elasticsearch
1

Hi,

I am using following query to get the aggs based on date on per day interval with extended_bounds

/index1

{
    "size": 0,
    "query":{"bool":{"must":[{"range":{"CreatedDate":{"lte":"2020-02-13T23:59:59"}}}]}},
    "aggs": {
        "new_users": {
            "filter": {
                "range": {
                    "CreatedDate": {
                        "gte": "2020-01-15T00:00:00",
                        "lte": "2020-02-13T23:59:59"
                    }
                }
            },
            "aggs": {
                "user_growth_by_month": {
                    "date_histogram": {
                        "field": "CreatedDate",
                        "interval": "day",
                        "format": "date_optional_time",
                        "time_zone": "-12:00",
                        "min_doc_count": 0,
                        "extended_bounds": {
                            "min": "2020-01-15T00:00:00",
                            "max": "2020-02-13T23:59:59"
                        }
                    },
                    "aggs": {
                        "cumulative_growth": {
                            "cumulative_sum": {
                                "buckets_path": "_count"
                            }
                        }
                    }
                }
            }
        }
    }
}

As mentioned in the query, I have given the range of date "gte": "2020-01-15T00:00:00", but in the response, the buckets are starting with the previous date.

"buckets": [
                    {
                        "cumulative_growth": {
                            "value": 1
                        },
                        "doc_count": 1,
                        "key": 1579003200000,
                        "key_as_string": "2020-01-14T00:00:00.000-12:00"
                    },
                    {
                        "cumulative_growth": {
                            "value": 4
                        },
                        "doc_count": 3,
                        "key": 1579089600000,
                        "key_as_string": "2020-01-15T00:00:00.000-12:00"
                    }
]

So, instead of getting 30 buckets, I am receving 31 buckets.

While debugging, I noticed this behavior happening for the given date range only.

Thanks

2

Hey,

is it possible to simplify and remove some variables from this sample and also share the full output as well as the Elasticsearch version you are working with?

First, move the filter agg range to the query range (also note that this date is UTC).
Second, remove the pipeline agg.

if the response is still not what you expect, can you put the request+response in a gist and link it?

Thanks!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.