Hello, we are using the Elasticsearch API, to do an aggregation with two fields and we get the following error: Merging/Reducing the multi_term aggregations failed when computing the aggregation GroupByLevel & GroupByProcessId because the field in the position 2 in the aggregation has two different types in two different indices.
We are aggregating the level.keyword and the processId fields which are treated as keyword and long respectively and are both marked as aggregatable (checked the indexed fields from Kibana). This used to work some time ago, when the level.keyword field was treated as string, possibly due to invalid formatting/test logs, but after installing on a blank environment and creating new logs it threw the above error.
The request we send to the Elasticsearch API:
{
"aggs": {
"GroupByLevel & GroupByProcessId": {
"aggs": {
"GroupByLevel & GroupByProcessId": {
"aggs": {
"AvgProcessMemoryInMB": {
"aggs": {
"AvgProcessMemoryInMB": {
"avg": {
"field": "processMemoryInMB"
}
}
},
"filter": {
"match_all": {}
}
}
},
"multi_terms": {
"terms": [
{
"field": "level.keyword"
},
{
"field": "processId"
}
]
}
}
},
"filter": {
"match_all": {}
},
"meta": {
"0": "level.keyword",
"1": "processId"
}
}
}
}
Elasticsearch version: 7.14.0
Logstash version: 7.14.0
Kibana version: 7.14.0