stats count() by span(timestmap, 5 min):

exprValue1: 00:01:00  // window=[00:00:00, 00,05:00)
exprValue2: 00:22:00 // window=[00:20:00, 00:25:00)

// Without special handling:
window1=[00:00:00, 00:05:00), 1
window2=[00:20:00, 00:25:00), 1

// With empty window filled in-between:
window1=[00:00:00, 00:05:00), 1
window2=[00:05:00, 00:10:00), null
window3=[00:10:00, 00:15:00), null
window4=[00:15:00, 00:20:00), null
window5=[00:20:00, 00:25:00), 1

PUT span-test
{
  "mappings": {
    "properties": {
      "eventTime": {
        "type": "date"
      }
    }
  }
}

POST span-test/_bulk
{ "index" : { "_id" : "1" } }
{ "eventTime" : "2022-11-03T00:01:00Z" }
{ "index" : { "_id" : "2" } }
{ "eventTime" : "2022-11-03T00:10:00Z" }

POST _plugins/_ppl
{
  "query": """
    source = span-test
    | stats count(1) by span(eventTime, 5m) AS windowStartTime
  """
}

# Explain the PPL query above to get DSL query as below
POST span-test/_search
{"from":0,"size":0,"timeout":"1m","aggregations":{"composite_buckets":{"composite":{"size":1000,"sources":[{"span(eventTime,5m)":{"date_histogram":{"field":"eventTime","missing_bucket":true,"missing_order":"first","order":"asc","fixed_interval":"5m"}}}]},"aggregations":{"count(1)":{"value_count":{"field":"_index"}}}}}}

{
  "schema": [
    {
      "name": "count(1)",
      "type": "integer"
    },
    {
      "name": "windowStartTime",
      "type": "timestamp"
    }
  ],
  "datarows": [
    [
      1,
      "2022-11-03T00:00:00.000+0000"
    ],
    [
      1,
      "2022-11-03T00:10:00.000+0000"
    ]
  ],
  "total": 3,
  "size": 3
}