Thank you @elasticforme.
The relevant part in the query you provided is "fixed_interval" : "2592000000ms" which represent the length of a month (30 days) in milliseconds.
Elasticsearch has two ways in which it can represent an interval in a date_histogram: a calendar interval and a fixed interval. There is a detailed explanation on the differences between the two in this section from the documentation.
In SQL we chose to represent these as fixed intervals, and the behavior you get is the result of this choice. We did make a change for YEAR to behave like a calendar interval and we could to the same for MONTH and maybe DAY.
Can you, please, open an issue in https://github.com/elastic/elasticsearch/ about an improvement to GROUP BY HISTOGRAM where the interval is 1 MONTH or 1 DAY? Thanks.