Hi,
Can you please include a json document that is like 10 minutes after the time of graph series showing zero? If you change time ranges do you see any differences?
Also, you could use the query inspector feature to check the response that is actually coming back from the query before rendered in graph.
Also, I think the following topic sounds familiar to your problem: Data Missing Past Midnight (ES Data Source)
Marcus