<p dir="auto">I've reproduced this on the DEB package (might likely applies to the RPM package also).</p>
<p dir="auto">I ran across a scenario wherein user was using the DEB package. Then they opened the <code class="notranslate">/etc/elasticsearch/elasticsearch.yml</code> file and changed <code class="notranslate">path.plugins</code> to point to a different folder (anything really)</p>
<p dir="auto">After this, they installed Marvel (or any plugin for that matter). Unfortunately, the plugin was installed into <code class="notranslate">/usr/share/elasticsearch/plugins</code> instead of picking up the <code class="notranslate">path.plugins</code> override in the elasticsearch.yml file. Thus when starting ES, the plugin does not load correctly.</p>
<p dir="auto">This can be potentially fixed by changing the plugin script line to:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="exec $JAVA $JAVA_OPTS -Xmx64m -Xms16m -Delasticsearch -Des.path.home=&quot;$ES_HOME&quot; -Des.config=&quot;/etc/elasticsearch/elasticsearch.yml&quot; $properties -cp &quot;$ES_HOME/lib/*&quot; org.elasticsearch.plugins.PluginManager $args"><pre class="notranslate"><code class="notranslate">exec $JAVA $JAVA_OPTS -Xmx64m -Xms16m -Delasticsearch -Des.path.home="$ES_HOME" -Des.config="/etc/elasticsearch/elasticsearch.yml" $properties -cp "$ES_HOME/lib/*" org.elasticsearch.plugins.PluginManager $args
</code></pre></div>
<p dir="auto">I'm not 100% sure if this has other implications or is the right approach here.</p>
<p dir="auto">I've been trying to make sense of Elasticssearch histogram aggregations the last couple of days. And I've found that they don't work as expected, or even advertised.</p>
<p dir="auto">Lets say i want to aggregate like so:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&quot;aggregations&quot;: {
  &quot;sea_water_temperature&quot;: {
    &quot;histogram&quot;: {
      &quot;field&quot;: &quot;sea_water_temperature&quot;,
      &quot;interval&quot;: 3
    }
  }
}"><pre class="notranslate"><code class="notranslate">"aggregations": {
  "sea_water_temperature": {
    "histogram": {
      "field": "sea_water_temperature",
      "interval": 3
    }
  }
}
</code></pre></div>
<p dir="auto">Response buckets looks fine at first glance, but when trying to query for documents within the bounds of a bucket I don't get the same document count as the bucket suggested. E.g.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&quot;filter&quot;: {
  &quot;range&quot;: {
    &quot;sea_water_temperature&quot;: {
      &quot;lt&quot;: 0,
      &quot;gte&quot;: -3
    }
  }
}"><pre class="notranslate"><code class="notranslate">"filter": {
  "range": {
    "sea_water_temperature": {
      "lt": 0,
      "gte": -3
    }
  }
}
</code></pre></div>
<p dir="auto">This could give x results while the bucket "-3" had a doc_count of y. This seems to only be an issue for negative bucket keys.</p>
<p dir="auto">In the docs for histogram it states that the bucket key for a given value is:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="rem = value % interval
if (rem &lt; 0) {
  rem += interval
}
bucket_key = value - rem"><pre class="notranslate"><code class="notranslate">rem = value % interval
if (rem &lt; 0) {
  rem += interval
}
bucket_key = value - rem
</code></pre></div>
<p dir="auto">However I tried a term aggregation with that as a value script:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&quot;aggregations&quot;: {
  &quot;sea_water_temperature&quot;: {
    &quot;terms&quot;: {
      &quot;field&quot;: &quot;sea_water_temperature&quot;,
      &quot;script&quot;: &quot;rem = _value % interval; rem = rem &lt; 0 ? rem + interval : rem; _value - rem&quot;,
      &quot;params&quot;: {
        &quot;interval&quot;: 3
      }
    }
  }
}"><pre class="notranslate"><code class="notranslate">"aggregations": {
  "sea_water_temperature": {
    "terms": {
      "field": "sea_water_temperature",
      "script": "rem = _value % interval; rem = rem &lt; 0 ? rem + interval : rem; _value - rem",
      "params": {
        "interval": 3
      }
    }
  }
}
</code></pre></div>
<p dir="auto">That gives me the same kind of bucketing as histogram does but now my filter queries actually match the doc_counts of the buckets(!). Why isn't histogram working as described? or am I missing something?</p>