'Elastic SQL translate API ignored a count

I had to write a simple query in Elastic and (I'm lazy) I choose to write a (working) SQL equivalent query and let Elastic translate it:

SELECT 
  count(*)/7.0 AS moving_average, 
  sum(CASE WHEN "@timestamp" > DATE_ADD('days', -2, CURRENT_DATE) THEN 1 ELSE 0 END) AS yesterday_value 
FROM "index-*" 
WHERE "@timestamp" < CURRENT_DATE
  AND "@timestamp" > DATE_ADD('days', -8, CURRENT_DATE) 
GROUP BY field

I received this query:

{
"size": 0,
"query": {
    "range": {
        "@timestamp": {
            "from": "2022-01-26T00:00:00.000Z",
            "to": "2022-02-03T00:00:00.000Z",
            "include_lower": false,
            "include_upper": false,
            "time_zone": "Z",
            "format": "strict_date_optional_time_nanos",
            "boost": 1.0
        }
    }
},
"_source": false,
"aggregations": {
    "groupby": {
        "composite": {
            "size": 1000,
            "sources": [
                {
                    "c3b53914": {
                        "terms": {
                            "field": "field.keyword",
                            "missing_bucket": true,
                            "order": "asc"
                        }
                    }
                }
            ]
        },
        "aggregations": {
            "fd78731a": {
                "stats": {
                    "script": {
                        "source": "InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.gt(InternalQlScriptUtils.docValue(doc,params.v0),InternalSqlScriptUtils.asDateTime(params.v1))) ? params.v2 : params.v3",
                        "lang": "painless",
                        "params": {
                            "v0": "@timestamp",
                            "v1": "2022-02-01T00:00:00.000Z",
                            "v2": 1,
                            "v3": 0
                        }
                    }
                }
            }
        }
    }
}
}

Now: this query has some problems, for example uses the actual current date and not some datemath expression like now-8d/d, but the main problem is that it's ignoring the /7.0 part (and also the painless script is not working as expected).

In the end, I had to write it from scratch (and divide by 7 in a later passage - or use a moving function aggregation):

{
    "size": 0,
    "query": {
        "range": {
            "@timestamp": {
                "from": "now-8d/d",
                "to": "now-1d/d",
                "include_lower": false,
                "include_upper": true,
                "time_zone": "Z",
                "format": "strict_date_optional_time_nanos",
                "boost": 1.0
            }
        }
    },
    "_source": false,
    "aggregations": {
        "groupby": {
            "composite": {
                "size": 100,
                "sources": [
                    {
                        "field": {
                            "terms": {
                                "field": "field",
                                "missing_bucket": true,
                                "order": "asc"
                            }
                        }
                    }
                ]
            },
            "aggregations": {
                "doc_count_yesterday": {
                    "range": {
                        "field": "@timestamp",
                        "ranges": [{
                            "from": "now-1d/d",
                            "to": "now/d"
                        }]
                    }
                }
            }
        }
    }
}

Does anybody know this phenomenon? It doesn't seem to appear in the SQL limitations.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source