{

"size": 0,

"query": {

"bool": {

"filter": [

{ "term": {"type": "my_type"}},

{"range": {"my_field": {"gt": 1456866925, "lte": 1456867040}}},

{"terms": {"my_name": ["name"]}},

{"terms": {"my_application_name": ["ap1"]}}

]

}

},

"aggs": {

"group_by_state": {

"terms": {

"script": "[doc['my_name'].value.replace(':',''),doc['my_application_name'].value].join(':')",

"order": {

"_term": "asc"

}

},

"aggs": {

"volume_over_time": {

"histogram": {

"field": "my_field",

"interval": "10",

"min_doc_count": 0

},

"aggs": {

"chart_field": {

"avg": {

"script": "(doc['temp'].value/(1024*1024))"

}

}

}

}

}

}

}

}

Can you post the mappings of your index, in particular the mapping for `my_field`

?

That could be because you have interval=10 and it starts at 1456866920 which is just before 1456866925 in the first 10-unit range.

The mapping for my_field is double here.

But it should not start at 1456866920 which is just before 1456866925. Otherwise there is no point of using filter if it does not give correct output

The output is correct, it's just that the bucket keys are rounded to fit the interval you've specified.

With an interval of 10, 1456866925 will be "rounded" to 1456866920 to make up the key of the first bucket, then the second bucket will be 1456866930, etc

If you try with an interval of 1 or 5, then the first bucket will be 1456866925

If you try with an interval of 2, then the first bucket will be 1456866924

etc