Specify bucket key to start from specified value in elastic search(6.7) date histogram

Question

I have a index in elastic search which stores system alerts. This index has values like startTime and endTime of alert.I need to fetch date histogram which specifies the minutely/hourly occurrences of alerts in specified time interval. To fetch I used the following query :

GET ocm_alert/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [

        {
          "range": {
            "endTime": {
              "from": 1561393800000,
              "to": null,
              "include_lower": true,
              "include_upper": true,
              "boost": 1
            }
          }
        },
        {
          "range": {
            "startTime": {
              "from": null,
              "to": 1562828606000,
              "include_lower": true,
              "include_upper": false,
              "boost": 1
            }
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  },
  "aggregations": {
    "aggs_by_time": {
      "date_histogram": {
        "script": {
          "source": "long startTime = doc['startTime'].value.toInstant().toEpochMilli(); long endTime = doc['endTime'].value.toInstant().toEpochMilli(); List dates = new ArrayList();  long rangeFrom = startTime < 1561116600000l ? 1561116600000l : startTime; long rangeTo = endTime > 1562828606000l ? 1562828606000l : endTime; for(long date = rangeFrom; date < rangeTo ; date+=3600000){dates.add(date)} dates.add(rangeTo);return dates;",
          "lang": "painless"
        },
        "interval": "1h",
        "offset": 0,
        "order": {
          "_key": "asc"
        },
        "keyed": false,
        "min_doc_count": 1
      },
      "aggregations": {
        "aggs_by_severity": {
          "min": {
            "field": "severity"
          }
        }
      }
    }
  }
}

The result is fine but the key in the result is calculated using the date field i calculated in script. For e.g if alert startTime is 12:15:00 then key is calculated as 11:30:00 and second key is 12:30:00. But I need to start the key values based on the startTime I specified in the query like 12:00:00. So that the aggregation keys are 12:00:00 , 13:00:00.

Answer 1

A bit of hack I guess or this is how it is supposed to be done. I calculated the offset value based on the startTime I specified in query clause and added the offset to the date histogram aggregation along with timezone and it worked.