I am filtering in ElasticSearch. I want doc_count to return 0 on non-data dates, but it doesn't print those dates at all, only dates with data are returned to me. do you know how i can do it? Here is the Python output:

0                                                     NaN
1                                                     NaN
2                                                     NaN
3                                                     NaN
4                                                     NaN
                               ...                       
33479    {'date': '2022-04-13T08:08:00.000Z', 'value': 7}
33480    {'date': '2022-04-13T08:08:00.000Z', 'value': 7}
33481    {'date': '2022-04-13T08:08:00.000Z', 'value': 7}
33482    {'date': '2022-04-13T08:08:00.000Z', 'value': 7}
33483    {'date': '2022-04-13T08:08:00.000Z', 'value': 7}

And here is my ElasticSearch filter:

"from": 0,
    "size": 0,
    "query": {
        "bool": {
            "must":
                [
                    {
                        "range": {
                            "@timestamp": {
                                "gte": "now-1M",
                                "lt": "now"
                            }
                        }
                    }
                ]
        }
    },
    "aggs": {
        "continent": {
            "terms": {
                "field": "source.geo.continent_name.keyword"
            },
            "aggs": {
                "_source": {
                    "date_histogram": {
                        "field": "@timestamp", "interval": "8m"
                    }}}}}}

CodePudding user response：

You need to set min_doc_count value to 0 for aggregation where you want result with zero doc_count.

{
  "from": 0,
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": "now-1M",
              "lt": "now"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "continent": {
      "terms": {
        "field": "source.geo.continent_name.keyword",
        "min_doc_count": 0
      },
      "aggs": {
        "_source": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": "8m",
            "min_doc_count": 0
          }
        }
      }
    }
  }
}