Bucket Script and Gaps

[bianca6]

Hi,

According to the documentation, the bucket script should be able to deal with gaps:

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline.html#gap-policy

But in my case, I got the following error:

"caused_by" : {
    "type" : "null_pointer_exception",
    "reason" : "Cannot invoke \"Object.getClass()\" because \"leftObject\" is null"
}

I expected the gaps to be replace by 0, not to return me an error.

Here is my bucket script:

"download": {
  "aggs": {
    "type": {
      "terms": {
        "field": "event.fields.message.keyword"
      },
      "aggs": {
        "count": {
          "value_count": {
            "field": "timestamp"
          }
        }
      }
    }
  },
  "download_error_percentage": {
    "bucket_script": {
      "buckets_path": {
        "start": "download>type['Download']>count.value",
        "succ": "download>type['Download (SUCCEEDED)']>count.value",
        "fail": "download>type['Download (FAILED)']>count.value"
      },
      "gap_policy": "insert_zeros",
      "script": "params.fail / params.start"
    }
  }
}

I expect the "download_error_percentage" to be the operation result or 0 (if there is no 'Download (FAILED)')

[spinscale (Alexander Reelsen)]

Do you have a minimal example to share including index creation, mapping and few sample documents to reproduce?

[bianca6]

More information:

There are a lot of logs, to make it simple we can see them as:

timestamp = t1, object = 1, event.fields.message.keyword = Download
timestamp = t2, object = 1, event.fields.message.keyword = Download Succedded
timestamp = t3, object = 2, event.fields.message.keyword = Download
timestamp = t4, object = 2, event.fields.message.keyword = Download Failed

Then, I did a Transform in order to get an "entity-centric" view, the group by is based on the field "object".

I use this transform to get the duration of download for my objects, but also the error %.

The code above is a part of my transform (aggregations). I used the bucket script in order to calculate the duration (I just substract the min an max timestamp per object).

But now, I'm trying to use another bucket script, this time for the error %. But, the missing values (not every objects is 'failed' or 'succeeded') cause an error as shown above (Cannot invoke "Object.getClass()" because "leftObject" is null)

[spinscale (Alexander Reelsen)]

With minimal example I meant a snippet that I can copy & paste into the Kibana Dev Tools