How to shift back just the end datetime in timefitler?

[YuWatanabe]

I have a requirement where I need to calculate the difference from 2 data sets. The two datasets will have different timerange.

ex.
Dataset1: 2019-01-01 00:00:00 - 2019-07-31 00:00:00
Dataset2: 2019-01-01 00:00:00 - 2019-08-01 00:00:00 ( <- specified in timefilter)

What I need to do is below.

(Dataset2: total count of fieldA) - (Dataset1: total count of fieldA) .

This could be done using transfrom in data object but I also want to dynamically calculate the timerange for Dataset1 .

Timerange shifting seems to fit my use case but this also slides the start datetime as well.

https://www.elastic.co/guide/en/kibana/7.1/vega-querying-elasticsearch.html

          @timestamp: {
            // "%timefilter%" will be replaced with
            // the current values of the time filter
            // (from the upper right corner)
            "%timefilter%": true
            // Only work with %timefilter%
            // Shift current timefilter by 10 units back
            shift: 10
            // week, day (default), hour, minute, second
            unit: minute

Can I just shift the end datetime of timefilter ?

Thanks,
Yu Watanabe

[rashmi (kulkarni)]

@nyuriks - can you shed some light here please ?

Thanks
Rashmi

[nyuriks (Yuri Astrakhan)]

Hi @YuWatanabe, I don't think this is possible at the moment, but it is definitely sounds like an interesting feature to have. Could you create an issue in github, possibly proposing the syntax. And of course any pull requests would be welcome

[YuWatanabe]

@nyuriks

Thanks for the follow up.
As a matter of fact, I found 2 similar issues in github issues.

[Vega] Use Kibana dashboard time filter context anywhere in Vega / Vega-lite spec

Issue: [Vega] Use Kibana dashboard time filter context anywhere in Vega / Vega-lite spec

[VEGA] enhance %timefilter% expansion features

Issue: [VEGA] enhance %timefilter% expansion features

Both using below syntax which I really wanted and these are now implemented and founded on doc too. Its a shame that I did not realize about this ...

{ %timefilter%: "min" }
{ %timefilter%: "max" }

Something like below should work for my case.

Timefilter for Dataset 1

"query": {
  "range": {
    "@timestamp": { 
      from: {%timefilter%: "min"},
      to: {%timefilter%: "max", shift: -1, unit: day}
    }
  }
}

Timefilter for Dataset2

"query": {
  "range": {
    "@timestamp": { 
      from: {%timefilter%: "min"},
      to: {%timefilter%: "max"}
    }
  }
}