[Lens] Time offset using filters

src/plugins/data/common/es_query/es_query/build_es_query.ts

@@ -50,6 +50,13 @@ export function buildEsQuery(
     config.allowLeadingWildcards,
     config.dateFormatTZ
   );
+  // TODO there is probably a more elegant way than this.
+  // We need to pass raw queries to the filters agg somehow
+  const rawQuery = buildQueryFromFilters(
+    queriesByLanguage.rawQuery ? (queriesByLanguage.rawQuery.map((q) => q.query) as Filter[]) : [],
+    indexPattern,
+    config.ignoreFilterIfFieldNotInIndex
+  );
   const luceneQuery = buildQueryFromLucene(
     queriesByLanguage.lucene,
     config.queryStringOptions,
@@ -63,10 +70,25 @@ export function buildEsQuery(
 
   return {
     bool: {
-      must: [...kueryQuery.must, ...luceneQuery.must, ...filterQuery.must],
-      filter: [...kueryQuery.filter, ...luceneQuery.filter, ...filterQuery.filter],
-      should: [...kueryQuery.should, ...luceneQuery.should, ...filterQuery.should],
-      must_not: [...kueryQuery.must_not, ...luceneQuery.must_not, ...filterQuery.must_not],
+      must: [...kueryQuery.must, ...luceneQuery.must, ...filterQuery.must, ...rawQuery.must],
+      filter: [
+        ...kueryQuery.filter,
+        ...luceneQuery.filter,
+        ...filterQuery.filter,
+        ...rawQuery.filter,
+      ],
+      should: [
+        ...kueryQuery.should,
+        ...luceneQuery.should,
+        ...filterQuery.should,
+        ...rawQuery.should,
+      ],
+      must_not: [
+        ...kueryQuery.must_not,
+        ...luceneQuery.must_not,
+        ...filterQuery.must_not,
+        ...rawQuery.must_not,
+      ],
     },
   };
 }

src/plugins/data/common/search/aggs/agg_config.ts

@@ -17,6 +17,7 @@ import {
   SerializedFieldFormat,
 } from 'src/plugins/expressions/common';
 
+import moment from 'moment';
 import { IAggType } from './agg_type';
 import { writeParams } from './agg_params';
 import { IAggConfigs } from './agg_configs';
@@ -172,6 +173,18 @@ export class AggConfig {
     return _.get(this.params, key);
   }
 
+  getTimeShift(): undefined | moment.Duration {
+    const rawTimeShift = this.getParam('timeShift');
+    if (!rawTimeShift) return undefined;
+    const [, amount, unit] = rawTimeShift.match(/(\d+)(\w)/);
+    return moment.duration(Number(amount), unit);
+  }
+
+  getTimeShiftedFilter(timeShift: moment.Duration, value: any) {
+    // TODO better handling for implementation vs no implementation
+    return this.type.getTimeShiftedFilter!(this, timeShift, value);
+  }
+
   write(aggs?: IAggConfigs) {
     return writeParams<AggConfig>(this.type.params, this, aggs);
   }

src/plugins/data/common/search/aggs/agg_type.ts

@@ -53,6 +53,7 @@ export interface AggTypeConfig<
   getValue?: (agg: TAggConfig, bucket: any) => any;
   getKey?: (bucket: any, key: any, agg: TAggConfig) => any;
   getValueBucketPath?: (agg: TAggConfig) => string;
+  getTimeShiftedFilter?: (agg: TAggConfig, timeShift: moment.Duration, value: any) => any;
 }
 
 // TODO need to make a more explicit interface for this
@@ -210,6 +211,8 @@ export class AggType<
 
   getValue: (agg: TAggConfig, bucket: any) => any;
 
+  getTimeShiftedFilter: (agg: TAggConfig, timeShift: moment.Duration, value: any) => any;
+
   getKey?: (bucket: any, key: any, agg: TAggConfig) => any;
 
   paramByName = (name: string) => {
@@ -283,6 +286,11 @@ export class AggType<
     this.getResponseAggs = config.getResponseAggs || (() => {});
     this.decorateAggConfig = config.decorateAggConfig || (() => ({}));
     this.postFlightRequest = config.postFlightRequest || identity;
+    this.getTimeShiftedFilter =
+      config.getTimeShiftedFilter ||
+      (() => {
+        throw new Error('not implemented');
+      });
 
     this.getSerializedFormat =
       config.getSerializedFormat ||

src/plugins/data/common/search/aggs/buckets/date_histogram.ts

@@ -133,6 +133,22 @@ export const getDateHistogramBucketAgg = ({
         },
       };
     },
+    getTimeShiftedFilter: (agg, timeShift, val) => {
+      const bucketStart = moment(val).subtract(timeShift);
+      updateTimeBuckets(agg, calculateBounds);
+
+      const { useNormalizedEsInterval } = agg.params;
+      const interval = agg.buckets.getInterval(useNormalizedEsInterval);
+      const bucketEnd = bucketStart.clone().add(interval);
+      return {
+        range: {
+          [agg.fieldName()]: {
+            gte: bucketStart.toISOString(),
+            lte: bucketEnd.toISOString(),
+          },
+        },
+      };
+    },
     params: [
       {
         name: 'field',

src/plugins/data/common/search/aggs/buckets/filters.ts

@@ -23,7 +23,7 @@ const filtersTitle = i18n.translate('data.search.aggs.buckets.filtersTitle', {
     'The name of an aggregation, that allows to specify multiple individual filters to group data by.',
 });
 
-interface FilterValue {
+export interface FilterValue {
   input: Query;
   label: string;
   id: string;

src/plugins/data/common/search/aggs/buckets/terms.ts

@@ -140,6 +140,10 @@ export const getTermsBucketAgg = () =>
       }
       return resp;
     },
+    getTimeShiftedFilter: (agg, _timeShift, val) => {
+      // TODO this doesn't work for other/missing buckets
+      return agg.createFilter(val).query;
+    },
     params: [
       {
         name: 'field',

src/plugins/data/common/search/aggs/metrics/count.ts

@@ -25,6 +25,13 @@ export const getCountMetricAgg = () =>
         defaultMessage: 'Count',
       });
     },
+    params: [
+      {
+        name: 'timeShift',
+        type: 'string',
+        write: () => {},
+      },
+    ],
     getSerializedFormat(agg) {
       return {
         id: 'number',

src/plugins/data/common/search/aggs/metrics/count_fn.ts

@@ -48,6 +48,10 @@ export const aggCount = (): FunctionDefinition => ({
         defaultMessage: 'Schema to use for this aggregation',
       }),
     },
+    timeShift: {
+      types: ['string'],
+      help: '',
+    },
     customLabel: {
       types: ['string'],
       help: i18n.translate('data.search.aggs.metrics.count.customLabel.help', {

src/plugins/data/common/search/aggs/types.ts

@@ -178,7 +178,7 @@ export interface AggParamsMapping {
   [BUCKET_TYPES.TERMS]: AggParamsTerms;
   [METRIC_TYPES.AVG]: AggParamsAvg;
   [METRIC_TYPES.CARDINALITY]: AggParamsCardinality;
-  [METRIC_TYPES.COUNT]: BaseAggParams;
+  [METRIC_TYPES.COUNT]: BaseAggParams & { timeShift?: string };
   [METRIC_TYPES.GEO_BOUNDS]: AggParamsGeoBounds;
   [METRIC_TYPES.GEO_CENTROID]: AggParamsGeoCentroid;
   [METRIC_TYPES.MAX]: AggParamsMax;