[BUG] NPE when using percentiles aggregation in extraction query

[wkruse]

Describe the bug

When using percentiles aggregation in extraction query like

"aggs": {
	"percentiles_duration": {
		"percentiles": {
			"field": "duration"
		}
	}
}

we are getting NullPointerException

java.lang.NullPointerException: Cannot invoke "org.opensearch.common.ParseField.getPreferredName()" because "this.valuesField" is null
	at org.opensearch.search.aggregations.metrics.AbstractPercentilesAggregationBuilder.doXContentBody(AbstractPercentilesAggregationBuilder.java:362) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.search.aggregations.support.ValuesSourceAggregationBuilder.internalXContent(ValuesSourceAggregationBuilder.java:466) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.search.aggregations.AbstractAggregationBuilder.toXContent(AbstractAggregationBuilder.java:172) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.search.aggregations.AggregatorFactories$Builder.toXContent(AggregatorFactories.java:541) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.common.xcontent.XContentBuilder.value(XContentBuilder.java:870) ~[opensearch-x-content-1.2.4.jar:1.2.4]
	at org.opensearch.common.xcontent.XContentBuilder.value(XContentBuilder.java:863) ~[opensearch-x-content-1.2.4.jar:1.2.4]
	at org.opensearch.common.xcontent.XContentBuilder.field(XContentBuilder.java:855) ~[opensearch-x-content-1.2.4.jar:1.2.4]
	at org.opensearch.search.builder.SearchSourceBuilder.innerToXContent(SearchSourceBuilder.java:1444) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.search.builder.SearchSourceBuilder.toXContent(SearchSourceBuilder.java:1487) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.common.xcontent.XContentHelper.toXContent(XContentHelper.java:471) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.search.builder.SearchSourceBuilder.toString(SearchSourceBuilder.java:1795) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.search.builder.SearchSourceBuilder.toString(SearchSourceBuilder.java:1790) ~[opensearch-1.2.4.jar:1.2.4]
	at org.opensearch.alerting.InputService.collectInputResults(InputService.kt:75) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
	at org.opensearch.alerting.InputService.collectInputResults$default(InputService.kt:53) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
	at org.opensearch.alerting.MonitorRunner$runQueryLevelMonitor$2.invokeSuspend(MonitorRunner.kt:299) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.3.72.jar:1.3.72-release-468 (1.3.72)]
	at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:233) [kotlinx-coroutines-core-1.1.1.jar:?]
	at kotlinx.coroutines.EventLoopImplBase.processNextEvent(EventLoop.kt:116) [kotlinx-coroutines-core-1.1.1.jar:?]
	at kotlinx.coroutines.BlockingCoroutine.joinBlocking(Builders.kt:76) [kotlinx-coroutines-core-1.1.1.jar:?]
	at kotlinx.coroutines.BuildersKt__BuildersKt.runBlocking(Builders.kt:53) [kotlinx-coroutines-core-1.1.1.jar:?]
	at kotlinx.coroutines.BuildersKt.runBlocking(Unknown Source) [kotlinx-coroutines-core-1.1.1.jar:?]
	at org.opensearch.alerting.MonitorRunner.runQueryLevelMonitor(MonitorRunner.kt:298) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
	at org.opensearch.alerting.transport.TransportExecuteMonitorAction$doExecute$$inlined$use$lambda$1$1.invokeSuspend(TransportExecuteMonitorAction.kt:75) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.3.72.jar:1.3.72-release-468 (1.3.72)]
	at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:233) [kotlinx-coroutines-core-1.1.1.jar:?]
	at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) [kotlinx-coroutines-core-1.1.1.jar:?]
	at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) [kotlinx-coroutines-core-1.1.1.jar:?]
	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) [kotlinx-coroutines-core-1.1.1.jar:?]
	Suppressed: java.lang.IllegalStateException: Failed to close the XContentBuilder
		at org.opensearch.common.xcontent.XContentBuilder.close(XContentBuilder.java:1027) ~[opensearch-x-content-1.2.4.jar:1.2.4]
		at org.opensearch.common.xcontent.XContentHelper.toXContent(XContentHelper.java:466) ~[opensearch-1.2.4.jar:1.2.4]
		at org.opensearch.search.builder.SearchSourceBuilder.toString(SearchSourceBuilder.java:1795) ~[opensearch-1.2.4.jar:1.2.4]
		at org.opensearch.search.builder.SearchSourceBuilder.toString(SearchSourceBuilder.java:1790) ~[opensearch-1.2.4.jar:1.2.4]
		at org.opensearch.alerting.InputService.collectInputResults(InputService.kt:75) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
		at org.opensearch.alerting.InputService.collectInputResults$default(InputService.kt:53) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
		at org.opensearch.alerting.MonitorRunner$runQueryLevelMonitor$2.invokeSuspend(MonitorRunner.kt:299) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
		at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.3.72.jar:1.3.72-release-468 (1.3.72)]
		at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:233) [kotlinx-coroutines-core-1.1.1.jar:?]
		at kotlinx.coroutines.EventLoopImplBase.processNextEvent(EventLoop.kt:116) [kotlinx-coroutines-core-1.1.1.jar:?]
		at kotlinx.coroutines.BlockingCoroutine.joinBlocking(Builders.kt:76) [kotlinx-coroutines-core-1.1.1.jar:?]
		at kotlinx.coroutines.BuildersKt__BuildersKt.runBlocking(Builders.kt:53) [kotlinx-coroutines-core-1.1.1.jar:?]
		at kotlinx.coroutines.BuildersKt.runBlocking(Unknown Source) [kotlinx-coroutines-core-1.1.1.jar:?]
		at org.opensearch.alerting.MonitorRunner.runQueryLevelMonitor(MonitorRunner.kt:298) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
		at org.opensearch.alerting.transport.TransportExecuteMonitorAction$doExecute$$inlined$use$lambda$1$1.invokeSuspend(TransportExecuteMonitorAction.kt:75) [opensearch-alerting-1.2.4.0.jar:1.2.4.0]
		at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.3.72.jar:1.3.72-release-468 (1.3.72)]
		at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:233) [kotlinx-coroutines-core-1.1.1.jar:?]
		at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) [kotlinx-coroutines-core-1.1.1.jar:?]
		at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) [kotlinx-coroutines-core-1.1.1.jar:?]
		at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) [kotlinx-coroutines-core-1.1.1.jar:?]
	Caused by: java.io.IOException: Unclosed object or array found
		at org.opensearch.common.xcontent.json.JsonXContentGenerator.close(JsonXContentGenerator.java:469) ~[opensearch-x-content-1.2.4.jar:1.2.4]
		at org.opensearch.common.xcontent.XContentBuilder.close(XContentBuilder.java:1025) ~[opensearch-x-content-1.2.4.jar:1.2.4]
		... 19 more

Other plugins installed
Security plugin is disabled

To Reproduce
Steps to reproduce the behavior:

1. Go to Alerting> Monitors > Create monitor
2. Click on Per query monitor
3. Click on Extraction query editor
4. Define a query with percentiles aggregation
5. See error in the OpenSearch server logs

Expected behavior
The expected behavior is that percentiles aggregation works (like for example the extended_stats).

Additional context
The percentile_ranks aggregation is also broken.

We are running the official OpenSearch 1.2.4 (with Security plugin disabled) and OpenSearch Dashboards 1.2.0 Docker containers.

[hjkempel]

+1

[sbcd90]

hi @wkruse , this issue is fixed now. The fix will be available in Opensearch 1.3. Also the main branch contains the fix.
kindly let me know if this issue occurs again.