Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bucket_scripts about nested.field will lead Java elasticsearch exception in Some situations #26376

Closed
anhzhi opened this issue Aug 25, 2017 · 6 comments
Assignees

Comments

@anhzhi
Copy link

anhzhi commented Aug 25, 2017

Elasticsearch version:
"number": "5.3.1",
"build_hash": "5f9cf58",
"build_date": "2017-04-17T15:52:53.846Z",
"build_snapshot": false,
"lucene_version": "6.4.2"

JVM version (java -version):
java version "1.8.0_45"

OS version :
Ubuntu 14.04.5 LTS
Linux 3.19.0-26-generic #28~14.04.1-Ubuntu SMP

Steps to reproduce:
cc-gossip-test-2017.08.24 is a time-series index with nested path: snmp.ifXTableStats and snmp.ifXTableStats

GET /cc-gossip-test-2017.08.24/_mapping
{
   "cc-gossip-test-2017.08.24": {
      "mappings": {
         "_default_": {
            "dynamic_templates": [
               {
                  "ip_fields": {
                     "match": "*_ip",
                     "match_mapping_type": "string",
                     "mapping": {
                        "type": "ip"
                     }
                  }
               },
               {
                  "string_fields": {
                     "match": "*",
                     "match_mapping_type": "string",
                     "mapping": {
                        "index": "not_analyzed",
                        "omit_norms": true,
                        "type": "string"
                     }
                  }
               }
            ],
            "properties": {
               "@timestamp": {
                  "type": "date"
               }
            }
         },
         "snmp": {
            "dynamic_templates": [
               {
                  "ip_fields": {
                     "match": "*_ip",
                     "match_mapping_type": "string",
                     "mapping": {
                        "type": "ip"
                     }
                  }
               },
               {
                  "string_fields": {
                     "match": "*",
                     "match_mapping_type": "string",
                     "mapping": {
                        "index": "not_analyzed",
                        "omit_norms": true,
                        "type": "string"
                     }
                  }
               }
            ],
            "properties": {
               "@timestamp": {
                  "type": "date"
               },
               "appname": {
                  "type": "keyword"
               },
               "guid": {
                  "type": "keyword"
               },
               "snmp": {
                  "properties": {
                     "CpuUtilization": {
                        "type": "long"
                     },
                     "MachineIP": {
                        "type": "keyword"
                     },
                     "MemUtilization": {
                        "type": "long"
                     },
                     "PingStats": {
                        "type": "boolean"
                     },
                     "SysDescr": {
                        "type": "keyword"
                     },
                     "SysModel": {
                        "type": "keyword"
                     },
                     "SysName": {
                        "type": "keyword"
                     },
                     "SysUpTime": {
                        "type": "keyword"
                     },
                     "SysVendor": {
                        "type": "keyword"
                     },
                     "ifTableStats": {
                        "type": "nested",
                        "properties": {
                           "ifInDiscards": {
                              "type": "long"
                           },
                           "ifName": {
                              "type": "keyword"
                           },
                           "ifOperStatus": {
                              "type": "long"
                           }
                        }
                     },
                     "ifXTableStats": {
                        "type": "nested",
                        "properties": {
                           "ifHCInBroadcastPkts": {
                              "type": "long"
                           },
                           "ifHCInMulticast": {
                              "type": "long"
                           },
                           "ifHCInOid": {
                              "type": "long"
                           },
                           "ifHCInPkts": {
                              "type": "long"
                           },
                           "ifHCOutBroadcastPkts": {
                              "type": "long"
                           },
                           "ifHCOutMulticastPkts": {
                              "type": "long"
                           },
                           "ifHCOutOid": {
                              "type": "long"
                           },
                           "ifHCOutPkts": {
                              "type": "long"
                           },
                           "ifName": {
                              "type": "keyword"
                           }
                        }
                     }
                  }
               },
               "tags": {
                  "type": "keyword"
               },
               "type": {
                  "type": "keyword"
               }
            }
         }
      }
   }
}

GET /cc-gossip-test-2017.08.24/_search?size=1
{
   "took": 1798,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 30400,
      "max_score": 1,
      "hits": [
         {
            "_index": "cc-gossip-test-2017.08.24",
            "_type": "snmp",
            "_id": "AV4TCrbADEKu3Ndpt8QU",
            "_score": 1,
            "_source": {
               "tags": [
                  "192.168.10.40",
                  "snmp",
                  "test"
               ],
               "@timestamp": 1503558022122,
               "appname": "gossip",
               "snmp": {
                  "SysVendor": "Hillstone",
                  "MemUtilization": 11,
                  "CpuUtilization": 2,
                  "SysDescr": "Hillstone Security Appliance SG-6000-E5960",
                  "SysName": "YOUFU-JR-FW-E5960-2",
                  "ifXTableStats": [
                     {
                        "ifHCOutMulticastPkts": 321,
                        "ifHCInPkts": 811365,
                        "ifHCInBroadcastPkts": 759,
                        "ifHCInMulticast": 871,
                        "ifHCInOid": 356495,
                        "ifName": "vswitchif1",
                        "ifHCOutPkts": 548666,
                        "ifHCOutOid": 661142,
                        "ifHCOutBroadcastPkts": 612
                     },
                     {
                        "ifHCOutMulticastPkts": 839,
                        "ifHCInPkts": 272703,
                        "ifHCInBroadcastPkts": 121,
                        "ifHCInMulticast": 130,
                        "ifHCInOid": 680241,
                        "ifName": "ethernet0/0",
                        "ifHCOutPkts": 667500,
                        "ifHCOutOid": 498357,
                        "ifHCOutBroadcastPkts": 514
                     },
                     {
                        "ifHCOutMulticastPkts": 141,
                        "ifHCInPkts": 897571,
                        "ifHCInBroadcastPkts": 891,
                        "ifHCInMulticast": 963,
                        "ifHCInOid": 890749,
                        "ifName": "ethernet0/1",
                        "ifHCOutPkts": 392301,
                        "ifHCOutOid": 465144,
                        "ifHCOutBroadcastPkts": 966
                     },
                     {
                        "ifHCOutMulticastPkts": 154,
                        "ifHCInPkts": 905458,
                        "ifHCInBroadcastPkts": 875,
                        "ifHCInMulticast": 444,
                        "ifHCInOid": 775080,
                        "ifName": "ethernet0/2",
                        "ifHCOutPkts": 577087,
                        "ifHCOutOid": 203788,
                        "ifHCOutBroadcastPkts": 333
                     },
                     {
                        "ifHCOutMulticastPkts": 410,
                        "ifHCInPkts": 196321,
                        "ifHCInBroadcastPkts": 193,
                        "ifHCInMulticast": 250,
                        "ifHCInOid": 251012,
                        "ifName": "ethernet0/3",
                        "ifHCOutPkts": 634786,
                        "ifHCOutOid": 466457,
                        "ifHCOutBroadcastPkts": 947
                     },
                     {
                        "ifHCOutMulticastPkts": 834,
                        "ifHCInPkts": 902,
                        "ifHCInBroadcastPkts": 844,
                        "ifHCInMulticast": 727,
                        "ifHCInOid": 736986,
                        "ifName": "ethernet0/4",
                        "ifHCOutPkts": 309988,
                        "ifHCOutOid": 260248,
                        "ifHCOutBroadcastPkts": 384
                     },
                     {
                        "ifHCOutMulticastPkts": 121,
                        "ifHCInPkts": 937043,
                        "ifHCInBroadcastPkts": 957,
                        "ifHCInMulticast": 633,
                        "ifHCInOid": 973661,
                        "ifName": "ethernet0/5",
                        "ifHCOutPkts": 29120,
                        "ifHCOutOid": 771836,
                        "ifHCOutBroadcastPkts": 207
                     },
                     {
                        "ifHCOutMulticastPkts": 159,
                        "ifHCInPkts": 280022,
                        "ifHCInBroadcastPkts": 799,
                        "ifHCInMulticast": 343,
                        "ifHCInOid": 265569,
                        "ifName": "ethernet0/6",
                        "ifHCOutPkts": 834883,
                        "ifHCOutOid": 912451,
                        "ifHCOutBroadcastPkts": 802
                     },
                     {
                        "ifHCOutMulticastPkts": 598,
                        "ifHCInPkts": 498934,
                        "ifHCInBroadcastPkts": 591,
                        "ifHCInMulticast": 251,
                        "ifHCInOid": 151818,
                        "ifName": "ethernet0/7",
                        "ifHCOutPkts": 884749,
                        "ifHCOutOid": 874863,
                        "ifHCOutBroadcastPkts": 600
                     },
                     {
                        "ifHCOutMulticastPkts": 925,
                        "ifHCInPkts": 765505,
                        "ifHCInBroadcastPkts": 294,
                        "ifHCInMulticast": 266,
                        "ifHCInOid": 419455,
                        "ifName": "ethernet0/8",
                        "ifHCOutPkts": 889155,
                        "ifHCOutOid": 18616,
                        "ifHCOutBroadcastPkts": 131
                     },
                     {
                        "ifHCOutMulticastPkts": 847,
                        "ifHCInPkts": 165705,
                        "ifHCInBroadcastPkts": 865,
                        "ifHCInMulticast": 347,
                        "ifHCInOid": 455523,
                        "ifName": "ethernet0/9",
                        "ifHCOutPkts": 355353,
                        "ifHCOutOid": 526783,
                        "ifHCOutBroadcastPkts": 550
                     },
                     {
                        "ifHCOutMulticastPkts": 729,
                        "ifHCInPkts": 662102,
                        "ifHCInBroadcastPkts": 984,
                        "ifHCInMulticast": 85,
                        "ifHCInOid": 916364,
                        "ifName": "xethernet2/0",
                        "ifHCOutPkts": 355035,
                        "ifHCOutOid": 483309,
                        "ifHCOutBroadcastPkts": 463
                     },
                     {
                        "ifHCOutMulticastPkts": 426,
                        "ifHCInPkts": 927963,
                        "ifHCInBroadcastPkts": 762,
                        "ifHCInMulticast": 421,
                        "ifHCInOid": 727607,
                        "ifName": "xethernet2/1",
                        "ifHCOutPkts": 404410,
                        "ifHCOutOid": 802485,
                        "ifHCOutBroadcastPkts": 750
                     },
                     {
                        "ifHCOutMulticastPkts": 285,
                        "ifHCInPkts": 782108,
                        "ifHCInBroadcastPkts": 146,
                        "ifHCInMulticast": 15,
                        "ifHCInOid": 22182,
                        "ifName": "xethernet2/2",
                        "ifHCOutPkts": 507986,
                        "ifHCOutOid": 75500,
                        "ifHCOutBroadcastPkts": 35
                     },
                     {
                        "ifHCOutMulticastPkts": 888,
                        "ifHCInPkts": 647820,
                        "ifHCInBroadcastPkts": 229,
                        "ifHCInMulticast": 145,
                        "ifHCInOid": 422669,
                        "ifName": "xethernet2/3",
                        "ifHCOutPkts": 429870,
                        "ifHCOutOid": 334679,
                        "ifHCOutBroadcastPkts": 703
                     },
                     {
                        "ifHCOutMulticastPkts": 991,
                        "ifHCInPkts": 668256,
                        "ifHCInBroadcastPkts": 338,
                        "ifHCInMulticast": 362,
                        "ifHCInOid": 389453,
                        "ifName": "aggregate1",
                        "ifHCOutPkts": 507659,
                        "ifHCOutOid": 154418,
                        "ifHCOutBroadcastPkts": 483
                     }
                  ],
                  "PingStats": true,
                  "SysModel": "Hillstone",
                  "ifTableStats": [
                     {
                        "ifInDiscards": 4,
                        "ifName": "vswitchif1",
                        "ifOperStatus": 1
                     },
                     {
                        "ifInDiscards": 1,
                        "ifName": "ethernet0/0",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 2,
                        "ifName": "ethernet0/1",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 4,
                        "ifName": "ethernet0/2",
                        "ifOperStatus": 1
                     },
                     {
                        "ifInDiscards": 0,
                        "ifName": "ethernet0/3",
                        "ifOperStatus": 1
                     },
                     {
                        "ifInDiscards": 4,
                        "ifName": "ethernet0/4",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 3,
                        "ifName": "ethernet0/5",
                        "ifOperStatus": 1
                     },
                     {
                        "ifInDiscards": 6,
                        "ifName": "ethernet0/6",
                        "ifOperStatus": 1
                     },
                     {
                        "ifInDiscards": 7,
                        "ifName": "ethernet0/7",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 0,
                        "ifName": "ethernet0/8",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 6,
                        "ifName": "ethernet0/9",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 2,
                        "ifName": "xethernet2/0",
                        "ifOperStatus": 1
                     },
                     {
                        "ifInDiscards": 10,
                        "ifName": "xethernet2/1",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 5,
                        "ifName": "xethernet2/2",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 9,
                        "ifName": "xethernet2/3",
                        "ifOperStatus": 0
                     },
                     {
                        "ifInDiscards": 4,
                        "ifName": "aggregate1",
                        "ifOperStatus": 0
                     }
                  ],
                  "SysUpTime": "113day 15h21m14s",
                  "MachineIP": "192.168.254.76"
               },
               "guid": "test",
               "type": "snmp"
            }
         }
      ]
   }
}

snmp.ifXTableStats.ifHCInPkts is a nested field and in long data_type
Bucket_scripts about nested.field will lead Java elasticsearch exception in Some situations:

Search Request:
POST /cc-gossip-test-2017.08.24/_search
{
   "from": 0,
   "aggs": {
      "snmp.ifXTableStats": {
         "aggs": {
            "snmp.ifXTableStats": {
               "filter": {
                  "bool": {
                     "must": []
                  }
               },
               "aggs": {
                  "cj6qal8gy00083c5ttt25sajj": {
                     "bucket_script": {
                        "buckets_path": {
                           "_t_a5bd8820": "_t_a5bd8820"
                        },
                        "script": {
                           "lang": "groovy",
                           "inline": "_t_a5bd8820"
                        }
                     }
                  },
                  "_t_a5bd8820": {
                     "avg": {
                        "field": "snmp.ifXTableStats.ifHCInPkts"
                     }
                  }
               }
            }
         },
         "nested": {
            "path": "snmp.ifXTableStats"
         }
      }
   },
   "size": 0
}

Search Response:
{
   "error": {
      "root_cause": [],
      "type": "reduce_search_phase_exception",
      "reason": "[reduce] ",
      "phase": "fetch",
      "grouped": true,
      "failed_shards": [],
      "caused_by": {
         "type": "class_cast_exception",
         "reason": "org.elasticsearch.search.aggregations.bucket.filter.InternalFilter cannot be cast to org.elasticsearch.search.aggregations.InternalMultiBucketAggregation"
      }
   },
   "status": 503
}

Provide logs (if relevant):
[2017-08-25T10:01:53,169][DEBUG][o.e.a.s.TransportSearchAction] [AmO7Hox] failed to reduce search
org.elasticsearch.action.search.ReduceSearchPhaseException: [reduce]
at org.elasticsearch.action.search.AbstractSearchAsyncAction$2.onFailure(AbstractSearchAsyncAction.java:548) [elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.onFailure(ThreadContext.java:623) [elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:39) [elasticsearch-5.3.1.jar:5.3.1]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_45]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_45]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_45]
Caused by: java.lang.ClassCastException: org.elasticsearch.search.aggregations.bucket.filter.InternalFilter cannot be cast to org.elasticsearch.search.aggregations.InternalMultiBucketAggregation
at org.elasticsearch.search.aggregations.pipeline.bucketscript.BucketScriptPipelineAggregator.reduce(BucketScriptPipelineAggregator.java:92) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.search.aggregations.InternalAggregation.reduce(InternalAggregation.java:109) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.search.aggregations.InternalAggregations.reduce(InternalAggregations.java:158) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.search.aggregations.bucket.InternalSingleBucketAggregation.doReduce(InternalSingleBucketAggregation.java:106) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.search.aggregations.InternalAggregation.reduce(InternalAggregation.java:107) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.search.aggregations.InternalAggregations.reduce(InternalAggregations.java:158) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.action.search.SearchPhaseController.merge(SearchPhaseController.java:518) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.action.search.AbstractSearchAsyncAction$2.doRun(AbstractSearchAsyncAction.java:539) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:638) ~[elasticsearch-5.3.1.jar:5.3.1]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-5.3.1.jar:5.3.1]
... 3 more

@anhzhi
Copy link
Author

anhzhi commented Aug 25, 2017

this issue is some like https://github.com/elastic/elasticsearch/issues/25845
Sum Buckets Aggregation does not work with Nested / Reverse Nested Aggregation

@anhzhi
Copy link
Author

anhzhi commented Aug 25, 2017

Other Test cases of help:
If inserted a term aggregation, it will give the expected result:

Search Request
POST /cc-gossip-test-2017.08.24/_search
{
   "from": 0,
   "aggs": {
      "snmp.ifXTableStats": {
         "aggs": {
            "snmp.ifXTableStats": {
               "filter": {
                  "bool": {
                     "must": []
                  }
               },
               "aggs": {
                  "cj6qakw6f00073c5te75udm75": {
                     "terms": {
                        "field": "snmp.ifXTableStats.ifName",
                        "size": 1
                     },
                     "aggs": {
                        "cj6qal8gy00083c5ttt25sajj": {
                           "bucket_script": {
                              "buckets_path": {
                                 "_t_8daa19d0": "_t_8daa19d0"
                              },
                              "script": {
                                 "lang": "groovy",
                                 "inline": "_t_8daa19d0*8/30"
                              }
                           }
                        },
                        "_t_8daa19d0": {
                           "avg": {
                              "field": "snmp.ifXTableStats.ifHCInPkts"
                           }
                        }
                     }
                  }
               }
            }
         },
         "nested": {
            "path": "snmp.ifXTableStats"
         }
      }
   },
   "size": 0
}

Response:
{
   "took": 84,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 30400,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "snmp.ifXTableStats": {
         "doc_count": 486400,
         "snmp.ifXTableStats": {
            "doc_count": 486400,
            "cj6qakw6f00073c5te75udm75": {
               "doc_count_error_upper_bound": 30400,
               "sum_other_doc_count": 456000,
               "buckets": [
                  {
                     "key": "aggregate1",
                     "doc_count": 30400,
                     "_t_8daa19d0": {
                        "value": 502785.6380263158
                     },
                     "cj6qal8gy00083c5ttt25sajj": {
                        "value": 134076.17014035088
                     }
                  }
               ]
            }
         }
      }
   }
}

@anhzhi
Copy link
Author

anhzhi commented Aug 25, 2017

If replaced the empty-filter-aggregation with a meaningless-terms-aggregation, it also works:

Search Request:
POST /cc-gossip-test-2017.08.24/_search
{
   "from": 0,
   "aggs": {
      "snmp.ifXTableStats": {
         "aggs": {
            "snmp.ifXTableStats": {
               "terms": {
                  "script": {
                     "lang": "groovy",
                     "inline": "'total'"
                  }
               },
               "aggs": {
                  "cj6qal8gy00083c5ttt25sajj": {
                     "bucket_script": {
                        "buckets_path": {
                           "_t_a5bd8820": "_t_a5bd8820"
                        },
                        "script": {
                           "lang": "groovy",
                           "inline": "_t_a5bd8820"
                        }
                     }
                  },
                  "_t_a5bd8820": {
                     "avg": {
                        "field": "snmp.ifXTableStats.ifHCInPkts"
                     }
                  }
               }
            }
         },
         "nested": {
            "path": "snmp.ifXTableStats"
         }
      }
   },
   "size": 0
}

Response:
{
   "took": 484,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 30400,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "snmp.ifXTableStats": {
         "doc_count": 486400,
         "snmp.ifXTableStats": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
               {
                  "key": "total",
                  "doc_count": 486400,
                  "_t_a5bd8820": {
                     "value": 499477.43625616777
                  },
                  "cj6qal8gy00083c5ttt25sajj": {
                     "value": 499477.43625616777
                  }
               }
            ]
         }
      }
   }
}

@anhzhi
Copy link
Author

anhzhi commented Aug 25, 2017

If removed the bucket-script aggregation, it also works as expected:

Search Request:
POST /cc-gossip-test-2017.08.24/_search
{
   "from": 0,
   "aggs": {
      "snmp.ifXTableStats": {
         "aggs": {
            "snmp.ifXTableStats": {
               "filter": {
                  "bool": {
                     "must": []
                  }
               },
               "aggs": {
                  "_t_a5bd8820": {
                     "avg": {
                        "field": "snmp.ifXTableStats.ifHCInPkts"
                     }
                  }
               }
            }
         },
         "nested": {
            "path": "snmp.ifXTableStats"
         }
      }
   },
   "size": 0
}

Rsponse:
{
   "took": 64,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 30400,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "snmp.ifXTableStats": {
         "doc_count": 486400,
         "snmp.ifXTableStats": {
            "doc_count": 486400,
            "_t_a5bd8820": {
               "value": 499477.43625616777
            }
         }
      }
   }
}

@colings86
Copy link
Contributor

This actually has nothing to do with the the nested field. The reason your first example above fails is because the filter aggregation is not a multi-bucket aggregation. The bucket_script aggregation requires that it's parent aggregation is a multi-bucket aggregation.

If you use the filters aggregation instead of the filter aggregation your first example should work.

@anhzhi
Copy link
Author

anhzhi commented Nov 1, 2017

@colings86 thanks a lot, it help me a lot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants