[esaggs] > Cannot read property 'doc_count' of undefined

[stacey-gammon]

bubbles.json.txt
Found in 7.3

Splitting out from #41240

1. If I take the request from the metric_filter visualization and paste it into the Dev Tools it works and I get back a good response. Here's that response;

{
  "took": 52,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 3,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 14005,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "2": {
      "buckets": {
        "{\"query_string\":{\"query\":\"machine.os.keyword:\\\"win 8\\\"\"}}": {
          "doc_count": 2838
        }
      }
    }
  },
  "status": 200
}

If I change the query from lucene to KQL, then it works;

And the response has changed to;

{
  "took": 24,
  "timed_out": false,
  "_shards": {
    "total": 3,
    "successful": 3,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 14005,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "2": {
      "buckets": {
        "machine.os.keyword:\"win 8\"": {
          "doc_count": 2838
        }
      }
    }
  },
  "status": 200
}

If I change the filter back to lucene I get this error;

So it's strange that when I open the visualization and the filter is using lucence I initially get this error;

but after changing it to KQL and back to lucene I get the different error.

[elasticmachine]

Pinging @elastic/kibana-app-arch

[stacey-gammon]

It also looks like, at least on master, this causes an infinite loop

The dashboard search source JSON is:

{
  "filter": [
    {
      "query": {
        "match_all": {}
      }
    }
  ],
  "highlightAll": true,
  "version": true,
  "query": {
    "query": "",
    "language": "kuery"
  }
}

I think that is the same shape that it would be in 7.2, so even though there are no filters showing in 7.2, the empty filter I suspect, is still there.

[stacey-gammon]

actually something interesting is that the searchSourceJSON is the same on the dashboard no_time and that does not have this issue. I think the filter must be coming from a visualization on that dashboard, not the dashboard itself.

[stacey-gammon]

Yea, it's metric_filter, and happens when not on a dashboard.

[lukeelmers]

it works and I get back a good response

I spent quite awhile today investigating this, and the stringified JSON in the bucket key of the response caught my attention:

  "aggregations": {
    "2": {
      "buckets": {
        "{\"query_string\":{\"query\":\"machine.os.keyword:\\\"win 8\\\"\"}}": {
          "doc_count": 2838
        }
      }
    }

This is in the response because we are sending it in the request like this:

  "aggs": {
    "2": {
      "filters": {
        "filters": {
          "{\"query_string\":{\"query\":\"machine.os.keyword:\\\"win 8\\\"\"}}": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "machine.os.keyword:\"win 8\""
                  }
                }
              ],
              "filter": [],
              "should": [],
              "must_not": []
            }
          }
        }
      }
    }

The bucket key that we send gets stringified here in agg_types/buckets/filters.js. This change was introduced in #37287 (Edit: It was still stringifying before this PR, but the logic was different).

If I re-type machine.os.keyword:"win 8" in the input for the split group filter on the metric vis, and hit apply, the request that goes out looks like this instead:

  "aggs": {
    "2": {
      "filters": {
        "filters": {
          "machine.os.keyword:\"win 8\"": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "machine.os.keyword:\"win 8\""
                  }
                }
              ],
              "filter": [],
              "should": [],
              "must_not": []
            }
          }
        }
      }
    }

Identical requests -- other than the different key name.

I made a hacky change to agg_types/buckets/filters.js just to see what would happen if I checked for a query_string query before stringifying:

const label = filter.label
  || matchAllLabel
  || (typeof filter.input.query === 'string'
    ? filter.input.query
    : filter.input.query.query_string
    ? filter.input.query.query_string.query
    : angular.toJson(filter.input.query));

The result was a request that was identical to the one that "worked", and the error was gone.

Next I checked out the changes introduced in #37287, I was able to confirm that the commit from that PR (c703ef1) is where the bug first appeared.

So, while the hack above technically "fixes" this, I want to make sure we solve this the right way. I'll consult with @Bargs tomorrow and get a PR open with a fix.

[lukeelmers]

There are two workarounds for anyone hitting this issue and waiting on the fix to be released. The issue will affect anyone with a visualization saved in an older (pre-7.0 I think) version of kibana which utilizes a query_string query:

1. Open the visualization, manually adjust the URL params, reload, then re-save the visualization:

// replace any instances of this:
query:(query_string:(query:'foo:%22bar%22'))

// with this:
query:'foo:%22bar%22'

2. Manually edit the saved object's visState, then re-save the object:

// replace any instances of this:
"query": {
    "query_string": {
        "query": "foo:\"bar\""
    }
}

// with this:
"query": "foo:\"bar\""