Skip to content

Some multi-bucket aggs cannot be used in pipeline aggs #53215

@jetnet

Description

@jetnet

Elasticsearch version: 7.6
Plugins installed: [ingest-attachment, ingest-opennl]

JVM version : openjdk version "13.0.2" 2020-01-14

OS version : Windows 10

Description of the problem including expected versus actual behavior:
Filter Agg and IP Range Agg cannot be used as a source for Pipeline Aggs

Steps to reproduce:
Example with the ip_range agg:

GET an_ECS_index/_search
{
  "size": 0,
  "aggs": {
    "1-bucket": {
      "ip_range": {
        "field": "destination.ip",
        "ranges": [
          {
            "mask": "192.168.0.0/16"
          },
          {
            "mask": "10.10.0.0/16"
          }
        ],
        "keyed": false
      }, 
      "aggs": {
        "1-metric": {
          "sum": {
            "field": "source.bytes"
          }
        }
      }
    },
    "1": {
      "sum_bucket": {
        "buckets_path": "1-bucket>1-metric"
      }
    }
  }
}

Error:

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "The first aggregation in buckets_path must be a multi-bucket aggregation for aggregation [1] found :org.elasticsearch.search.aggregations.bucket.range.IpRangeAggregationBuilder for buckets path: 1-bucket>1-metric"
      }

The similar error occurs when using filter agg.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions