Bucket script aggregation error

[Frank_Matera (Francis Matera)]

I am trying to create a bucket script based off of 2 single metric buckets and am having no luck.

My initial bucket query works:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "call_ty": "10"} },
        { "match": { "otg.keyword": "agg-0002363334"} }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "Attempts": {
      "value_count": { "field": "dur"}
    },
    "Completed":{
        "filter": {
          "range": {
          "dur": {
             "from" : 1 
          }
      }
    }
  }
}
}`Preformatted text`

Returning:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 10,
    "successful": 10,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 190,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "Attempts": {
      "value": 190
    },
    "Completed": {
      "doc_count": 23
    }
  }
}

When I try to add the bucket script I get an error:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "call_ty": "10"} },
        { "match": { "otg.keyword": "agg-0002363334"} }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "attempts": {
      "value_count": { "field": "dur"}
    },
    "completed":{
        "filter": {
          "range": {
          "dur": {
             "from" : 1 
          }
      }
    }
    },
  "ASR": {
    "bucket_script": {
      "buckets_path": {
        "att": "attempts",
        "com": "completed>_count"
      },
      "script": "com / att*100"
    }
  }
}
}

Error:

{
  "error": {
    "root_cause": [
      {
        "type": "aggregation_execution_exception",
        "reason": "Invalid pipeline aggregation named [ASR] of type [bucket_script]. Only sibling pipeline aggregations are allowed at the top level"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "cdrs2",
        "node": "7407ULsCQkWlIrFxhis8tg",
        "reason": {
          "type": "aggregation_execution_exception",
          "reason": "Invalid pipeline aggregation named [ASR] of type [bucket_script]. Only sibling pipeline aggregations are allowed at the top level"
        }
      }
    ]
  },
  "status": 500
}

Any assistance with this would be greatly appreciated. Thanks!

[abdon (Abdon Pijpelink)]

The buckets_path aggregation is a parent pipeline aggregation, which means it needs to be nested inside another aggregation. You can not provide it in the top level of your aggregation tree. Not only that, the parent aggregation needs to be a multi-bucket aggregation too.

Here's workaround (some would call it an ugly hack ) to get to what you need: nest your aggs inside a filters aggregation that contains just a single match_all filter:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "call_ty": "10"
          }
        },
        {
          "match": {
            "otg.keyword": "agg-0002363334"
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "all_matching_docs": {
      "filters": {
        "filters": {
          "all": {
            "match_all": {}
          }
        }
      },
      "aggs": {
        "attempts": {
          "value_count": {
            "field": "dur"
          }
        },
        "completed": {
          "filter": {
            "range": {
              "dur": {
                "from": 1
              }
            }
          }
        },
        "ASR": {
          "bucket_script": {
            "buckets_path": {
              "att": "attempts",
              "com": "completed>_count"
            },
            "script": "com / att*100"
          }
        }
      }
    }
  }
}

[Frank_Matera (Francis Matera)]

@abdon Thank you for your reply and explanation. When I run this, I am receiving an error that "com" is not defined.

{
  "error": {
    "root_cause": [],
    "type": "search_phase_execution_exception",
    "reason": "",
    "phase": "fetch",
    "grouped": true,
    "failed_shards": [],
    "caused_by": {
      "type": "script_exception",
      "reason": "compile error",
      "script_stack": [
        "com / att*100",
        "^---- HERE"
      ],
      "script": "com / att*100",
      "lang": "painless",
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "Variable [com] is not defined."
      }
    }
  },
  "status": 503
}

Using it without the bucket script, returns the correct results:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 190,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "all_matching_docs": {
      "buckets": {
        "all": {
          "doc_count": 190,
          "completed": {
            "doc_count": 23
          },
          "attempts": {
            "value": 190
          }
        }
      }
    }
  }
}

Thanks in advance.

[abdon (Abdon Pijpelink)]

Your script uses the old syntax for parameters. Try this as the script instead:

"script": "params.com / params.att*100"

[Frank_Matera (Francis Matera)]

Just entered that and it worked. Thanks again for your help!