Bucket_script error while using values from aggregation

Elastic Stack Elasticsearch
1

I am trying to calculate the difference between 2 aggregate values using bucket_script, but getting class_cast_exception error.

Here I am getting the current max connection count (now_cnx_count) and the average of past 4 weeks values (avg_previous_week). Now I using bucket_script to calculate the difference between 2 values.

Below is the query I am using:

{
"size": 0,
"aggs": {
"active_nbr" : {
"filter" : {
"term" : {
"_type" : "mytype"
}
},
"aggs": {
"now_cnx_count": {
"date_range": {
"field": "@timestamp",
"ranges": [
{
"from": "now-15m",
"to": "now"
}
]
},
"aggs": {
"n_cnx_count": {
"max": {
"field": "Cnx_Count"
}
}
}
},
"previous_week_cnx_count": {
"date_range": {
"field": "@timestamp",
"ranges": [
{
"from": "now-7d-15m",
"to": "now-7d"
},
{
"from": "now-14d-15m",
"to": "now-14d"
},
{
"from": "now-21d-15m",
"to": "now-21d"
},
{
"from": "now-28d-15m",
"to": "now-28d"
}
]
},
"aggs": {
"p_cnx_count": {
"max": {
"field": "Cnx_Count"
}
}
}
},
"avg_previous_week": {
"avg_bucket": {
"buckets_path": "previous_week_cnx_count>p_cnx_count"
}
},
"nowvspast_diff": {
"bucket_script": {
"buckets_path": {
"now_val": "now_cnx_count>n_cnx_count",
"past_val": "avg_previous_week"
},
"script": "params.now_val / params.past_val * 100"
}
}

  }
}

}
}

Error:

{
"error" : {
"root_cause" : [ ],
"type" : "reduce_search_phase_exception",
"reason" : "[reduce] ",
"phase" : "fetch",
"grouped" : true,
"failed_shards" : [ ],
"caused_by" : {
"type" : "class_cast_exception",
"reason" : null
}
},
"status" : 503
}

Can someone help me with this?

2

You cannot reference a multi-bucket aggregation in a buckets_path. In your case your now_val path is trying to reference an aggregation inside a date_range aggregation. Instead you should use a filter aggregation containing a range filter and use that for your bucket_path

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.