count different between Dashboard and API

The count of messages is not the same in dashboard and with API
## Expected Behavior

The count result iof message in dashboard for a absolute search must be the same with the same request by the API
## Current Behavior

Create a dashboard to count message from yesterday 2020-04:21 00:00:00 CET to 2020-04-21 23:59:59 CET
get the link with the "replay button :
`
http://graylog/search?rangetype=absolute&q=&streams=5cd979a62ead14227203a024&from=2020-04-20T22%3A00%3A00.000Z&to=2020-04-21T21%3A59%3A59.000Z
"
(zulu time it's ok)
create a widget :
count "alertmsg"
result : 2492017 (same in the original dashboard)

Try now with API

`
curl -iv -u 123456:token -H 'Accept: application/json' -X GET "http://graylog/api/search/universal/absolute/stats?field=alertmsg&query=*&from=2020-04-20T22:00:00.000Z&to=2020-04-21T21:59:59.000Z&streams=5cd979a62ead14227203a024"
***
> GET /api/search/universal/absolute/stats?field=alertmsg&query=*&from=2020-04-20T22:00:00.000Z&to=2020-04-21T21:59:59.000Z&streams=5cd979a62ead14227203a024 HTTP/1.1

> User-Agent: curl/7.29.0

> Accept: application/json
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< X-Graylog-Node-ID: d043ccb5-cb0f-4d7c-9b29-896b7df0a2ab
X-Graylog-Node-ID: d043ccb5-cb0f-4d7c-9b29-896b7df0a2ab
< X-Runtime-Microseconds: 310315
X-Runtime-Microseconds: 310315
< Content-Type: application/json
Content-Type: application/json
< Date: Wed, 22 Apr 2020 15:43:53 GMT
Date: Wed, 22 Apr 2020 15:43:53 GMT
< Content-Length: 1966
Content-Length: 1966

<
{"time":265,"count":3748229,"sum":"NaN","sum_of_squares":"NaN","mean":"NaN","min":"NaN","max":"NaN","variance":"NaN","std_deviation":"NaN","built_query":"{\n \"from\" : 0,\n \"query\" : {\n \"bool\" : {\n \"must\" : [\n {\n \"match_all\" : {\n \"boost\" : 1.0\n }\n }\n ],\n \"filter\" : [\n {\n \"bool\" : {\n \"must\" : [\n {\n \"range\" : {\n \"timestamp\" : {\n \"from\" : \"2020-04-20 22:00:00.000\",\n \"to\" : \"2020-04-21 21:59:59.000\",\n \"include_lower\" : true,\n \"include_upper\" : true,\n \"boost\" : 1.0\n }\n }\n }\n ],\n \"disable_coord\" : false,\n \"adjust_pure_negative\" : true,\n \"boost\" : 1.0\n }\n }\n ],\n \"disable_coord\" : false,\n \"adjust_pu* Connection #0 to host graylog left intact
re_negative\" : true,\n \"boost\" : 1.0\n }\n },\n \"aggregations\" : {\n \"gl2_value_count\" : {\n \"value_count\" : {\n \"field\" : \"alertmsg\"\n }\n },\n \"gl2_field_cardinality\" : {\n \"cardinality\" : {\n \"field\" : \"alertmsg\"\n }\n },\n \"gl2_filter\" : {\n \"filter\" : {\n \"bool\" : {\n \"must\" : [\n {\n \"range\" : {\n \"timestamp\" : {\n \"from\" : \"2020-04-20 22:00:00.000\",\n \"to\" : \"2020-04-21 21:59:59.000\",\n \"include_lower\" : true,\n \"include_upper\" : true,\n \"boost\" : 1.0\n }\n }\n }\n ],\n \"disable_coord\" : false,\n \"adjust_pure_negative\" : true,\n \"boost\" : 1.0\n }\n }\n }\n }\n}","cardinality":356}
`
"count":3748229," ??? not the same result

## Possible Solution

## Steps to Reproduce (for bugs)

1. create a widget count
2. select absolute time time range
3. replay the request with API (stats)
4. not the same count

## Context

result are different with API
## Your Environment

* Graylog Version: 3.2.4
* Elasticsearch Version: 6.8.4
* MongoDB Version: 2.6.12-6.el7
* Operating System: CentOS 7.7
* Browser version: Chrome Version 81.0.4044.92

User:
2020-04-22 17:57:56 +02:00
Your web browser:
2020-04-22 17:57:56 +02:00
Graylog server: