Range is not working as expected, I am using range from 1456866925 to 1456867040. result include data of 1456866920

Elastic Stack Elasticsearch
1

{
"size": 0,
"query": {
"bool": {
"filter": [
{ "term": {"type": "my_type"}},
{"range": {"my_field": {"gt": 1456866925, "lte": 1456867040}}},
{"terms": {"my_name": ["name"]}},
{"terms": {"my_application_name": ["ap1"]}}
]
}
},
"aggs": {
"group_by_state": {
"terms": {
"script": "[doc['my_name'].value.replace(':',''),doc['my_application_name'].value].join(':')",
"order": {
"_term": "asc"
}
},
"aggs": {
"volume_over_time": {
"histogram": {
"field": "my_field",
"interval": "10",
"min_doc_count": 0
},
"aggs": {
"chart_field": {
"avg": {
"script": "(doc['temp'].value/(1024*1024))"
}
}
}
}
}
}
}
}

2

Can you post the mappings of your index, in particular the mapping for my_field?

3

That could be because you have interval=10 and it starts at 1456866920 which is just before 1456866925 in the first 10-unit range.

4

The mapping for my_field is double here.

5

But it should not start at 1456866920 which is just before 1456866925. Otherwise there is no point of using filter if it does not give correct output

6

The output is correct, it's just that the bucket keys are rounded to fit the interval you've specified.

With an interval of 10, 1456866925 will be "rounded" to 1456866920 to make up the key of the first bucket, then the second bucket will be 1456866930, etc

If you try with an interval of 1 or 5, then the first bucket will be 1456866925
If you try with an interval of 2, then the first bucket will be 1456866924
etc