Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Monitoring] [UI] Multiple logstash pipelines aggregations are broken #50054

Closed
chrisronline opened this issue Dec 10, 2019 · 2 comments · Fixed by #50103
Closed

[Monitoring] [UI] Multiple logstash pipelines aggregations are broken #50054

chrisronline opened this issue Dec 10, 2019 · 2 comments · Fixed by #50103

Comments

@chrisronline
Copy link
Contributor

chrisronline commented Dec 10, 2019

See #44914 (comment)

Something changed recently in ES, triggering a slew of test failures (elastic/kibana#52470, elastic/kibana#52471, elastic/kibana#52476).

The culprit seems to be using bucket_script aggregations somewhere under a nested aggregation. In this scenario, the bucket_script aggregation doesn't seem to ever run, as the response does not contain the data.

(Partial copy-paste from the comment linked above)
See this example here: https://gist.github.com/chrisronline/836dbbdb594d5848538e412236f32147

For 7.5 and below, the output is:

{
  "aggregations" : {
    "date_histo" : {
      "buckets" : [
        {
          "in_nested" : {
            "types" : {
              "buckets" : [
                {
                  "bs_value" : {
                    "value" : 1.0
                  }
                }
              ]
            }
          },
          "high_level_bs_value" : {
            "value" : 0.0
          }
        }
      ]
    }
  }
}

For 7.6 and above, the output is:

{
  "aggregations" : {
    "date_histo" : {
      "buckets" : [
        {
          "high_level_bs_value" : {
            "value" : 0.0
          }
        }
      ]
    }
  }
}

Luckily, we have good test coverage for this, but this needs to be a blocker for 7.6

I've pinged @polyfractal about this and he is currently investigating. It sounds like this is also affecting other aggregation types too.

cc @elastic/stack-monitoring

@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-analytics-geo (:Analytics/Aggregations)

@polyfractal
Copy link
Contributor

I had a look at this last night, the changes in #45796 neglected to invoke pipeline reductions on the sub-aggs in SingleBucket aggs, meaning any pipeline under nested, filter, global, etc all fail to execute.

I have a fix and am writing up some tests, will get a PR up today I think.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants