We actually want to slice the data by the IST time zone, rather than slicing it according to the UTC time zone. This is possible by specifying the time_zone parameter. We need to separate the offset of the required time zone from the UTC time zone. In this case, we need to provide +05:30 as the offset, since IST is 5 hours and 30 minutes ahead of UTC:

GET /bigginsight/_search?size=0
{
  "aggs": {
    "counts_over_time": {
      "date_histogram": {
        "field": "time",
        "interval": "1d",
        "time_zone": "+05:30"
      }
    }
  }
}

The response now looks like the following:

{
  ...,
  "aggregations": {
    "counts_over_time": {
      "buckets": [
        {
          "key_as_string": "2017-09-23T00:00:00.000+05:30",
          "key": 1506105000000,
          "doc_count": 62493
        },
        {
          "key_as_string": "2017-09-24T00:00:00.000+05:30",
          "key": 1506191400000,
          "doc_count": 0
        },
        {
          "key_as_string": "2017-09-25T00:00:00.000+05:30",
          "key": 1506277800000,
          "doc_count": 180342
        }
      ]
    }
  }
}

As you can see, the key and key_as_string for all the buckets have changed. The keys are now at the beginning of the day, in the IST time zone. There are no documents for September 24, 2017, now, since it is a Sunday.