Can't filter Rollup index results

Elastic Stack Kibana
1

Hi,

I have a rollup index with some values, e.g. customer. I've created a Kibana dashboard from it. When I try to filter the dashboard with customer : some-customer, I get an error. When I do a custom query, I can filter by customer, but the trick is that I have to hit the /[index]/_rollup_search endpoint.

Is this the reason the Kibana dashboard doesn't work? Is there something I can make it work?

Both Kibana and Elasticsearch are at v7.9.1.

Kibana gives me a log output saying there was a 400 error, but Elasticsearch is silent.

2

Can you share the mappings of the rollup index, along with the exact query you are providing? And if you're using KQL or lucene query. I'm thinking there could be a syntax error with your query, somehow.

3
  • Mappings of the rollup index: here.
  • The exact query is what I wrote above: customer : some-customer. This is KQL, as far as I'm aware. I don't see the underlying Elasticsearch query that Kibana does.

I've tried debugging this while being on Visualize and I get more info here. If I filter for app : some-app, you can see the video here, I get the following in my chrome debugger tools:

{"statusCode":400,"error":"Bad Request","message":"[illegal_argument_exception] Unsupported Query in search request: [match]","attributes":{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Unsupported Query in search request: [match]"}],"type":"illegal_argument_exception","reason":"Unsupported Query in search request: [match]"}}}

Additionally, I have a problem doing an average of credits, video here, but a sum works okay. The error is:

{"statusCode":500,"error":"Internal Server Error","message":"[aggregation_execution_exception] Invalid aggregation order path [1]. The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets.","attributes":{"error":{"root_cause":[{"type":"aggregation_execution_exception","reason":"Invalid aggregation order path [1]. The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"stat_rollups","node":"UQqa5Uz0Ti2QrLk0cxX8NQ","reason":{"type":"aggregation_execution_exception","reason":"Invalid aggregation order path [1]. The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets.","caused_by":{"type":"illegal_argument_exception","reason":"The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets."}}}]}}}

So I'm guessing this is a bug in Kibana.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.