"aggs"クエリの出力結果が正しくありません

Question

特定の日時ウィンドウ（つまり2017-02-17T15:00:00.000と2017-02-17T16:00:00.000の間）のエントリ数を検索するクエリがあります。私は次のように2つのエントリを持ってmyindexで

{ 
    "took": 0, 
    "timed_out": false, 
    "_shards": { 
    "total": 5, 
    "successful": 5, 
    "failed": 0 
    }, 
    "hits": { 
    "total": 11, 
    "max_score": 0, 
    "hits": [] 
    }, 
    "aggregations": { 
    "range": { 
     "buckets": [ 
     { 
      "key": "*-2017-02-17T15:00:00.000Z", 
      "to": 1487343600000, 
      "to_as_string": "2017-02-17T15:00:00.000Z", 
      "doc_count": 0 
     }, 
     { 
      "key": "2017-02-17T16:00:00.000Z-*", 
      "from": 1487347200000, 
      "from_as_string": "2017-02-17T16:00:00.000Z", 
      "doc_count": 0 
     } 
     ] 
    } 
    } 
} 

：これは出力され

POST /myindex/_search 
{ 
    "size": 0, 
    "aggs": { 
    "range": { 
     "date_range": { 
      "field": "Datetime", 
      "ranges": [ 
       { "to": "2017-02-17T16:00:00||-1H/H" }, 
       { "from": "2017-02-17T16:00:00||/H" } 
      ] 
     } 
    } 
} 
} 

：私はこのクエリを実行すると、私は間違った結果を得る（それが良いでしょうが、結果は予想外であることを言いました） Datetimeの値：だから

2017-02-17T15:15:00.000Z 
2017-02-17T15:02:00.000Z 

、結果は2

と同じでなければなりません

現在の出力をどのように解釈するのか分かりません。エントリの数を定義するフィールドはどれですか？

UPDATE：

データ構造：

PUT /myindex 
{ 
    "mappings": { 
     "intensity": { 
     "_all": { 
     "enabled": false 
     }, 
     "properties": { 
      "Country_Id": { 
      "type":"keyword" 
      }, 
      "Datetime": { 
      "type":"date" 
      } 
     } 
     } 
    } 
} 

サンプルデータ：

{ 
    "took": 0, 
    "timed_out": false, 
    "_shards": { 
    "total": 5, 
    "successful": 5, 
    "failed": 0 
    }, 
    "hits": { 
    "total": 5, 
    "max_score": 1, 
    "hits": [ 
     { 
     "_index": "myindex", 
     "_type": "intensity", 
     "_id": "4", 
     "_score": 1, 
     "_source": { 
      "Country_Id": "1", 
      "Datetime": "2017-02-18T15:01:00.000Z" 
     } 
     }, 
     { 
     "_index": "myindex", 
     "_type": "intensity", 
     "_id": "6", 
     "_score": 1, 
     "_source": { 
      "Country_Id": "1", 
      "Datetime": "2017-03-16T16:15:00.000Z" 
     } 
     }, 
     { 
     "_index": "myindex", 
     "_type": "intensity", 
     "_id": "1", 
     "_score": 1, 
     "_source": { 
      "Country_Id": "1", 
      "Datetime": "2017-02-17T15:15:00.000Z" 
     } 
     }, 
     { 
     "_index": "myindex", 
     "_type": "intensity", 
     "_id": "7", 
     "_score": 1, 
     "_source": { 
      "Country_Id": "1", 
      "Datetime": "2017-03-16T16:18:00.000Z" 
     } 
     }, 
     { 
     "_index": "myindex", 
     "_type": "intensity", 
     "_id": "3", 
     "_score": 1, 
     "_source": { 
      "Country_Id": "1", 
      "Datetime": "2017-02-17T15:02:00.000Z" 
     } 
     } 
    ] 
    } 
} 

私が得る答え：

{ 
    "took": 2, 
    "timed_out": false, 
    "_shards": { 
    "total": 5, 
    "successful": 5, 
    "failed": 0 
    }, 
    "hits": { 
    "total": 11, 
    "max_score": 0, 
    "hits": [] 
    }, 
    "aggregations": { 
    "range": { 
     "buckets": [ 
     { 
      "key": "2017-02-17T15:00:00.000Z-2017-02-17T16:00:00.000Z", 
      "from": 1487343600000, 
      "from_as_string": "2017-02-17T15:00:00.000Z", 
      "to": 1487347200000, 
      "to_as_string": "2017-02-17T16:00:00.000Z", 
      "doc_count": 0 
     } 
     ] 
    } 
    } 
} 

Answer 1

のあなたの範囲が間違っている、このようにそれを行う代わりに、

POST /myindex/_search 
{ 
    "size": 0, 
    "aggs": { 
    "range": { 
     "date_range": { 
      "field": "Datetime", 
      "ranges": [ 
       { 
        "from": "2017-02-17T16:00:00Z||-1H/H", 
        "to": "2017-02-17T16:00:00Z||/H" 
       } 
      ] 
     } 
    } 
} 
}