Bucket script aggregation error

Elastic Stack Elasticsearch
1

I am trying to create a bucket script based off of 2 single metric buckets and am having no luck.

My initial bucket query works:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "call_ty": "10"} },
        { "match": { "otg.keyword": "agg-0002363334"} }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "Attempts": {
      "value_count": { "field": "dur"}
    },
    "Completed":{
        "filter": {
          "range": {
          "dur": {
             "from" : 1 
          }
      }
    }
  }
}
}`Preformatted text`

Returning:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 10,
    "successful": 10,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 190,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "Attempts": {
      "value": 190
    },
    "Completed": {
      "doc_count": 23
    }
  }
}

When I try to add the bucket script I get an error:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "call_ty": "10"} },
        { "match": { "otg.keyword": "agg-0002363334"} }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "attempts": {
      "value_count": { "field": "dur"}
    },
    "completed":{
        "filter": {
          "range": {
          "dur": {
             "from" : 1 
          }
      }
    }
    },
  "ASR": {
    "bucket_script": {
      "buckets_path": {
        "att": "attempts",
        "com": "completed>_count"
      },
      "script": "com / att*100"
    }
  }
}
}

Error:

{
  "error": {
    "root_cause": [
      {
        "type": "aggregation_execution_exception",
        "reason": "Invalid pipeline aggregation named [ASR] of type [bucket_script]. Only sibling pipeline aggregations are allowed at the top level"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "cdrs2",
        "node": "7407ULsCQkWlIrFxhis8tg",
        "reason": {
          "type": "aggregation_execution_exception",
          "reason": "Invalid pipeline aggregation named [ASR] of type [bucket_script]. Only sibling pipeline aggregations are allowed at the top level"
        }
      }
    ]
  },
  "status": 500
}

Any assistance with this would be greatly appreciated. Thanks!

1 Like
2

The buckets_path aggregation is a parent pipeline aggregation, which means it needs to be nested inside another aggregation. You can not provide it in the top level of your aggregation tree. Not only that, the parent aggregation needs to be a multi-bucket aggregation too.

Here's workaround (some would call it an ugly hack :wink:) to get to what you need: nest your aggs inside a filters aggregation that contains just a single match_all filter:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "call_ty": "10"
          }
        },
        {
          "match": {
            "otg.keyword": "agg-0002363334"
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "all_matching_docs": {
      "filters": {
        "filters": {
          "all": {
            "match_all": {}
          }
        }
      },
      "aggs": {
        "attempts": {
          "value_count": {
            "field": "dur"
          }
        },
        "completed": {
          "filter": {
            "range": {
              "dur": {
                "from": 1
              }
            }
          }
        },
        "ASR": {
          "bucket_script": {
            "buckets_path": {
              "att": "attempts",
              "com": "completed>_count"
            },
            "script": "com / att*100"
          }
        }
      }
    }
  }
}
3 Likes
3

@abdon Thank you for your reply and explanation. When I run this, I am receiving an error that "com" is not defined.

{
  "error": {
    "root_cause": [],
    "type": "search_phase_execution_exception",
    "reason": "",
    "phase": "fetch",
    "grouped": true,
    "failed_shards": [],
    "caused_by": {
      "type": "script_exception",
      "reason": "compile error",
      "script_stack": [
        "com / att*100",
        "^---- HERE"
      ],
      "script": "com / att*100",
      "lang": "painless",
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "Variable [com] is not defined."
      }
    }
  },
  "status": 503
}

Using it without the bucket script, returns the correct results:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 190,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "all_matching_docs": {
      "buckets": {
        "all": {
          "doc_count": 190,
          "completed": {
            "doc_count": 23
          },
          "attempts": {
            "value": 190
          }
        }
      }
    }
  }
}

Thanks in advance.

4

Your script uses the old syntax for parameters. Try this as the script instead:

"script": "params.com / params.att*100"

1 Like
5

Just entered that and it worked. Thanks again for your help!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.