Is it possible that the data you are analyzing contains timestamps in text format in the India timezone but without the timezone in the textual representation? In this case you'll end up with a _source
document that shows your original textual representation, which you'll interpret as India time. But Elasticsearch will have converted it to epoch milliseconds to store in the doc values on the assumption it's UTC. Then ML will analyze it and create results based on the epoch milliseconds stored in the doc values.
This thread discusses the way Elasticsearch converts textual timestamps assuming UTC unless the text contains a timezone: Storing Dates in Elastic Best Practices
If what I'm suggesting isn't clear then it might be easier to discuss a specific example. If you paste the _source
of one of the documents you're analyzing then I can talk specifically about it.