-
Notifications
You must be signed in to change notification settings - Fork 25.6k
Closed
Labels
Description
Elasticsearch version: 7.6
Plugins installed: [ingest-attachment, ingest-opennl]
JVM version : openjdk version "13.0.2" 2020-01-14
OS version : Windows 10
Description of the problem including expected versus actual behavior:
Filter Agg and IP Range Agg cannot be used as a source for Pipeline Aggs
Steps to reproduce:
Example with the ip_range agg:
GET an_ECS_index/_search
{
"size": 0,
"aggs": {
"1-bucket": {
"ip_range": {
"field": "destination.ip",
"ranges": [
{
"mask": "192.168.0.0/16"
},
{
"mask": "10.10.0.0/16"
}
],
"keyed": false
},
"aggs": {
"1-metric": {
"sum": {
"field": "source.bytes"
}
}
}
},
"1": {
"sum_bucket": {
"buckets_path": "1-bucket>1-metric"
}
}
}
}
Error:
{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "The first aggregation in buckets_path must be a multi-bucket aggregation for aggregation [1] found :org.elasticsearch.search.aggregations.bucket.range.IpRangeAggregationBuilder for buckets path: 1-bucket>1-metric"
}
The similar error occurs when using filter agg.