# About the agg request

**URL:** https://discuss.elastic.co/t/about-the-agg-request/58762
**Category:** Kibana
**Created:** [August 24, 2016, 4:13am UTC](https://discuss.elastic.co/t/about-the-agg-request/58762 "2016-08-24T04:13:44Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![BendMoly](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@BendMoly](https://discuss.elastic.co/u/BendMoly)
#### Post date: [August 24, 2016, 4:13am UTC](https://discuss.elastic.co/t/about-the-agg-request/58762/1 "2016-08-24T04:13:45Z")

</div>

Hi everyone, I need to create a new pieChart and split slices in bucket type, then click a piece of data in chart.

if I select the 'Date Histogram' as the sub Aggregation, the click event is normal and chart redraws the detail data which I click. But when I select other selection as the sub Aggregation like 'Terms', I click one piece of data would return an error:

`Visualize: Request to Elasticsearch failed` .

**the detail error**

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/fda0bcfb86cf599feac4405fefe98ed5b6503483.png)

I have compared the difference between the two request payloads in query field.  
**the normal**  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/8/81c4157392b0e464d8256c34fd673f5f6f5b1c4e.png)  
**the error**

 ![](https://us1.discourse-cdn.com/elastic/original/2X/6/640e2c8a6deec138338a51c86749681c6efd0b02.png)

What is the reason for this?  
How can I modify this request?  
What is the error mean?

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 24, 2016, 4:46pm UTC](https://discuss.elastic.co/t/about-the-agg-request/58762/2 "2016-08-24T16:46:39Z")

</div>

Hi BendMoly,

I'm on the Kibana 4.6.0 release candidate but I don't think anything in this area changed since the previous release. What Kibana version are you on?

I tried to reproduce your issue. I installed packetbeat thinking I might get mac addresses. I didn't get mac, but I got IP addresses and they're both un-analyzed strings so I think it's about the same.

I did a Split Splices Terms aggregation on Field ip. I only got three slices from my quick test data. When I click on one of the slices it creates a filter and now I only have results for that one IP address. No error.

Here's my request.

```auto
{
  "size": 0,
  "query": {
    "filtered": {
      "query": {
        "query_string": {
          "query": "*",
          "analyze_wildcard": true
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "query": {
                "match": {
                  "ip": {
                    "query": "209.18.47.61",
                    "type": "phrase"
                  }
                }
              },
              "$state": {
                "store": "appState"
              }
            },
            {
              "range": {
                "@timestamp": {
                  "gte": 1472042628486,
                  "lte": 1472057028486,
                  "format": "epoch_millis"
                }
              }
            }
          ],
          "must_not": []
        }
      }
    }
  },
  "aggs": {
    "2": {
      "terms": {
        "field": "ip",
        "size": 5,
        "order": {
          "_count": "desc"
        }
      }
    }
  }
}

```

Regards,  
Lee

Also, is this visualization using a saved search?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:40pm UTC](https://discuss.elastic.co/t/about-the-agg-request/58762/3 "2017-07-06T13:40:24Z")

</div>