如何在Elasticsearch聚合查询中自定义首个时间桶的起始时间？

Hey there! Let's figure out how to get those custom time buckets you need in Elasticsearch for your visualization. I've dealt with this exact scenario before, so here's what works:

Adjusting Time Buckets in Kibana (Visualization UI) #

If you're building your visualization in Kibana (like a line chart or bar graph), here's how to tweak the time buckets to match your custom frame:

• Open your visualization editor, then head to the Metrics & Buckets section—look for the date histogram bucket (usually on the X-axis).
• Instead of leaving the Interval set to "Auto", pick a fixed interval that fits your needs (like 3d for 3 days, which matches your system's original bucket length).
• The magic fix for the start time is the Offset parameter. Since your system starts buckets on 2018-03-02 but you want an earlier (or different) start, calculate the offset: if you want buckets to start on 2018-03-01, set the offset to -1d (this shifts all buckets back by 1 day).
• For even more control, use Custom Bounds in the same bucket settings. Enter your desired start time (e.g., 2018-03-01T00:00:00.000Z) and end time—this forces Elasticsearch to generate buckets starting exactly where you want, even if there's no data at that initial point.

Using Elasticsearch DSL for Direct Control #

If you're working with raw queries (via Dev Tools or API calls), you can define custom time buckets directly in your aggregation:

{
  "aggs": {
    "custom_time_buckets": {
      "date_histogram": {
        "field": "created",
        "fixed_interval": "3d", // Match your desired bucket length
        "offset": "-1d", // Shift buckets back by 1 day to start on 2018-03-01
        "extended_bounds": {
          "min": "2018-03-01T00:00:00.000Z", // Enforce your custom start time
          "max": "2024-01-01T00:00:00.000Z" // Replace with your end time
        }
      }
    }
  }
}

• fixed_interval: Ensures your buckets stay a consistent length (unlike the auto interval, which can change based on your time range).
• offset: Adjusts the start time of every bucket—use positive or negative values to shift things exactly where you need them.
• extended_bounds: Makes sure the first bucket starts at your custom time, even if there's no data there. This is perfect if you want a clean, consistent time frame regardless of your earliest data point.

Quick Extra Tips #

• If you need buckets aligned to calendar dates (like monthly buckets starting on the 1st, or weekly buckets starting on Monday), use calendar_interval instead of fixed_interval (e.g., calendar_interval: "month" with offset: "+0d").
• Don't forget to adjust your global time filter in Kibana to include your custom start time—otherwise, the filter might cut off the first bucket you just set up!

内容的提问来源于stack exchange，提问作者cekeriya