Doc_count type cast error while using bucket aggregations

[TEJASWI_CHUNDURI]

Using kibana 6.5.4

When checking the doc_count . it is replying with cast issue .. I need the results only doc_count <2

{
  "error": {
    "root_cause": [],
    "type": "search_phase_execution_exception",
    "reason": "",
    "phase": "fetch",
    "grouped": true,
    "failed_shards": [],
    "caused_by": {
      "type": "script_exception",
      "reason": "compile error",
      "script_stack": [
        "params.doc_count <= 1",
        "^---- HERE"
      ],
      "script": "params.doc_count <= 1",
      "lang": "painless",
      "caused_by": {
        "type": "class_cast_exception",
        "reason": "Cannot cast from [boolean] to [java.lang.Number]."
      }
    }
  },
  "status": 503
}

[polyfractal (Zachary Tong)]

The BucketScript pipeline agg is expected to emit a number, not a boolean which is why your script is failing.

What are you trying to achieve? You could emit a 0 or 1 if you're just wanting to set some kind of flag.

If you're wanting to remove buckets that are under a certain doc count, the bucket_selector pipeline agg is what you want: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html

[TEJASWI_CHUNDURI]

Hi polyfractal,

Please check the below where i used bucket selected where i need doc_count < 2 .. but response has the doc_counts

[polyfractal (Zachary Tong)]

Your bucket selector is a level too low. E.g. it is embedded under the "3" terms aggregation, meaning all buckets generated by "3" will be pruned. You'll need to move the selector up higher if you want it to affect the next level up.

Also note that the bucket selector saves the bucket when "true" is returned. So params.count < 2 means "save buckets that have a doc_count less than 2".

[TEJASWI_CHUNDURI]

POST /appscan*/_search
{
  "aggs": {
    "2": {
      "terms": {
        "field": "url_type_uniqref.keyword",
        "size": 35,
        "order": {
          "_count": "asc"
        }
      },
      "aggs": {
        "3": {
          "terms": {
            "field": "fversion.keyword",
            "size": 20,
            "order": {
              "_key": "desc"
            }
          },
            "bbukc": {
              "bucket_selector": {
                "buckets_path": {
                  "the_count": "_count"
                },
                "script": "params.the_count < 2"
              }
            },
          "aggs": {
            "1": {
              "max": {
                "field": "issue_group_item_cvss_score"
              }
            }
          }
        }
      }
    }

{
"error": {
"root_cause": [
{
"type": "parsing_exception",
"reason": "Found two aggregation type definitions in [3]: [terms] and [bbukc]",
"line": 20,
"col": 22
}
],
"type": "parsing_exception",
"reason": "Found two aggregation type definitions in [3]: [terms] and [bbukc]",
"line": 20,
"col": 22
},
"status": 400
}