Can't filter Rollup index results

Hi,

I have a rollup index with some values, e.g. customer. I've created a Kibana dashboard from it. When I try to filter the dashboard with customer : some-customer, I get an error. When I do a custom query, I can filter by customer, but the trick is that I have to hit the /[index]/_rollup_search endpoint.

Is this the reason the Kibana dashboard doesn't work? Is there something I can make it work?

Both Kibana and Elasticsearch are at v7.9.1.

Kibana gives me a log output saying there was a 400 error, but Elasticsearch is silent.

Can you share the mappings of the rollup index, along with the exact query you are providing? And if you're using KQL or lucene query. I'm thinking there could be a syntax error with your query, somehow.

  • Mappings of the rollup index: here.
  • The exact query is what I wrote above: customer : some-customer. This is KQL, as far as I'm aware. I don't see the underlying Elasticsearch query that Kibana does.

I've tried debugging this while being on Visualize and I get more info here. If I filter for app : some-app, you can see the video here, I get the following in my chrome debugger tools:

{"statusCode":400,"error":"Bad Request","message":"[illegal_argument_exception] Unsupported Query in search request: [match]","attributes":{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Unsupported Query in search request: [match]"}],"type":"illegal_argument_exception","reason":"Unsupported Query in search request: [match]"}}}

Additionally, I have a problem doing an average of credits, video here, but a sum works okay. The error is:

{"statusCode":500,"error":"Internal Server Error","message":"[aggregation_execution_exception] Invalid aggregation order path [1]. The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets.","attributes":{"error":{"root_cause":[{"type":"aggregation_execution_exception","reason":"Invalid aggregation order path [1]. The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"stat_rollups","node":"UQqa5Uz0Ti2QrLk0cxX8NQ","reason":{"type":"aggregation_execution_exception","reason":"Invalid aggregation order path [1]. The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets.","caused_by":{"type":"illegal_argument_exception","reason":"The provided aggregation [1] either does not exist, or is a pipeline aggregation and cannot be used to sort the buckets."}}}]}}}

So I'm guessing this is a bug in Kibana.