Hi,
I'm working on an aggregation over an application metrics log. I have got the composite aggregate to work except when I had the section "status_code", which is a nested aggregation, I get a 500 error with the status text of, "Cannot replay yet, collection is not finished: postCollect() has not been called"
Here's my agg query
{
"size": 0,
"track_total_hits": false,
"aggs": {
"c-buckets": {
"composite": {
"sources": [
{"time": {"date_histogram": {"field": "@timestamp", "interval": "1m", "order": "asc"}}},
{"env": {"terms": {"field": "env.keyword"}}},
{"host": {"terms": {"field": "host.keyword"}}},
{"proxy_host": {"terms": {"field": "proxy_host.keyword"}}},
{"endpoint": {"terms": {"field": "api.endpoint.keyword"}}},
{"accept": {"terms": {"field": "api.accept.keyword"}}},
{"client_key": {"terms": {"field": "api.client_key.keyword"}}},
{"code_version": {"terms": {"field": "code_version.keyword"}}}
]
},
"aggs": {
"load": {"cardinality": {"field": "api.request_id.keyword"}},
"threads": {"cardinality": {"field": "thread_name.keyword"}},
"user_name": {"cardinality": {"field": "api.user_name.keyword"}},
"exceptions": {"value_count": {"field": "stack_hash.keyword"}},
"elapsed_ms": {"extended_stats": {"field": "api.elapsed_millis", "sigma": 1}},
"started": {"filters": {"filters": {"start": {"match": {"message": "*START"}}}}},
"ended": {"filters": {"filters": {"end": {"match": {"caller_method_name.keyword": "logEnd"}}}}},
"long_running": {"filters": {"filters": {
"lr": {"match": {"caller_file_name.keyword": "LongRunningRequestLogger.java"}},
"zombie": {"match": {"message": "ZOMBIE"}}
}
},
"aggs": {
"requests": {"cardinality": {"field": "api.request_id.keyword"}}
}
},
"status_code": {"terms": {
"field": "api.status_code",
"collect_mode" : "breadth_first"},
"aggs": {
"elapsed_ms": {"extended_stats": {"field": "api.elapsed_millis", "sigma": 1}},
"user_name": {"cardinality": {"field": "api.user_name.keyword"}},
"threads": {"cardinality": {"field": "thread_name.keyword"}}
}
}
}
}
}
}
Is this the same thing referenced here? Metric aggregation fails in composite aggregation
Thanks,