How the fixed_interval time buckets were divided in date_histogram aggregation?

Elastic Stack Elasticsearch
1

Hi, I'm puzzled with the how the time buckets are divided with the fixed_interval in date_histogram aggregations. I have the following simple query:

{
  "query": {
    "bool": {
      "filter": [
        {"range": {"startTime": {"gte": "2020-03-01", "lte": "2020-03-14" } } }
      ]
    }
  },
 "aggs": {
        "my_buckets": {
          "date_histogram": { "fixed_interval": "7d", "field": "startTime" }
        }
    }
}

As you can see I want the data from 2020-03-01 to 2020-03-14, then I want the aggregation to be 7 days. My intuitive feeling was that elastic should give me two 7 day buckets, (2020-03-01 -> 2020-03-07), then (2020-03-08 -> 2020-03-14).

However, it's not the case. Elastic gives me 3 buckets. (Thursday 2020-02-27 -> Wednesday 2020-03-04), (Thursday 2020-03-05 -> Wednesday 2020-03-11) and (Thursday 2020-03-12 -> Wednesday 2020-03-19), the time bucket does NOT align with the start or end of my range, OR the calendar week.

I also tried different indexes, different query time ranges, but as long as my fixed_interval gives 7d, it always returns Thursday to Wednesday time buckets.

This gives me the feeling that the data were probably pre-aggregated in the Thursday to Wednesday buckets in side elastic search. So elastic cannot give me dynamic 7 days time bucket based on my query time range. If my suspicion was true, this is quite a big limitation to my use cases

Much appreciate if some one can help me understand the logic of the elastic date_histogram aggregation!

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.