Summary
Elastic DSL planning rejects some valid finite time ranges because time-bound resolution is incomplete.
Repro 1: mixed absolute and relative bounds
Configuration values:
- data_ingestion_interval_ms: 15000
- repetition_delay_ms: 300000
Query:
{
"aggs": { "sum_cpu": { "sum": { "field": "cpu_usage" } } },
"query": { "bool": { "filter": [{ "range": { "@timestamp": {
"gte": "2025-01-01T00:00:00Z", "lte": "now"
} }] } }
}
Expected: planning succeeds and emits a 300000ms tumbling window.
Actual: the planner resolves now relative to epoch zero, so the range can appear reversed and be rejected.
Repro 2: numeric epoch-millisecond bounds
Configuration values:
- data_ingestion_interval_ms: 15000
- repetition_delay_ms: 300000
Query:
{
"aggs": { "sum_cpu": { "sum": { "field": "cpu_usage" } } },
"query": { "bool": { "filter": [{ "range": { "@timestamp": {
"gte": 1700000000000, "lte": 1700000300000
} }] } }
}
Expected: planning succeeds and emits a 300000ms tumbling window.
Actual: numeric bounds are discarded during predicate extraction, so the planner reports that no usable time range exists.
Expected behavior
Use the actual planning reference time for relative date math and preserve numeric epoch bounds through predicate extraction and range resolution. Continue rejecting one-sided or otherwise non-finite ranges, while retaining the window invariants from #485.
Related: #485
Summary
Elastic DSL planning rejects some valid finite time ranges because time-bound resolution is incomplete.
Repro 1: mixed absolute and relative bounds
Configuration values:
Query:
{
"aggs": { "sum_cpu": { "sum": { "field": "cpu_usage" } } },
"query": { "bool": { "filter": [{ "range": { "@timestamp": {
"gte": "2025-01-01T00:00:00Z", "lte": "now"
} }] } }
}
Expected: planning succeeds and emits a 300000ms tumbling window.
Actual: the planner resolves now relative to epoch zero, so the range can appear reversed and be rejected.
Repro 2: numeric epoch-millisecond bounds
Configuration values:
Query:
{
"aggs": { "sum_cpu": { "sum": { "field": "cpu_usage" } } },
"query": { "bool": { "filter": [{ "range": { "@timestamp": {
"gte": 1700000000000, "lte": 1700000300000
} }] } }
}
Expected: planning succeeds and emits a 300000ms tumbling window.
Actual: numeric bounds are discarded during predicate extraction, so the planner reports that no usable time range exists.
Expected behavior
Use the actual planning reference time for relative date math and preserve numeric epoch bounds through predicate extraction and range resolution. Continue rejecting one-sided or otherwise non-finite ranges, while retaining the window invariants from #485.
Related: #485