We are using ELK 7.9.0 with downsampling turned on at 7 days. I have this query that works when the range is before the downsampling ocured. But if its in that range it gives me this exception.
This is the query
curl -u sysadmin:sysadmin -k -i https://<lab>:31001/mon-elasticsearch-client/metric*/_search?pretty -H 'Content-Type: application/json' -d '
{
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-10d",
"lte": "now-9d"
}
}
},
{
"term": {
"metricset.name": "uptime"
}
},
{
"term": {
"system.uid": "aa757b27-1234-1234-1234-bbb4380e05fd"
}
}
]
}
},
"aggregations": {
"hosts": {
"terms": {
"field": "host.name",
"size": 10000
},
"aggs": {
"uptimes_agg": {
"date_histogram": {
"field": "@timestamp",
"fixed_interval": "10m",
"extended_bounds": {
"min": "now-10d",
"max": "now-9d"
}
},
"aggs": {
"max_uptime": {
"max": {
"field": "system.uptime.duration.ms",
"missing": 0
}
}
}
}
}
}
},
"size": 0,
"track_total_hits": false
}'
And this is the error I get
date: Wed, 26 Jun 2024 20:29:46 GMT
content-type: application/json
x-elastic-product: Elasticsearch
strict-transport-security: max-age=15724800; includeSubDomains
{
"took" : 5,
"timed_out" : false,
"_shards" : {
"total" : 36,
"successful" : 32,
"skipped" : 32,
"failed" : 4,
"failures" : [
{
"shard" : 0,
"index" : "downsample-5m.ds-metricbeat-8.9.0-base-2024.06.14-000029",
"node" : "z3jbbGoeQ6avEnFriA50yg",
"reason" : {
"type" : "illegal_argument_exception",
"reason" : "Can't apply missing values on a class org.elasticsearch.xpack.aggregatemetric.aggregations.support.AggregateMetricsValuesSource$AggregateDoubleMetric$Fielddata"
}
},
{
"shard" : 0,
"index" : "downsample-5m.ds-metricbeat-8.9.0-base-2024.06.16-000032",
"node" : "_x0XtbSzQpqKLy7hcr-Qeg",
"reason" : {
"type" : "illegal_argument_exception",
"reason" : "Can't apply missing values on a class org.elasticsearch.xpack.aggregatemetric.aggregations.support.AggregateMetricsValuesSource$AggregateDoubleMetric$Fielddata"
}
}
]
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : 0.0,
"hits" : [ ]
}
}
If I remove missing from the the max_uptime aggregate the query does not produced an error. Is there a way to get around this without loosing this setting of 0? Max aggregation | Elasticsearch Guide [8.14] | Elastic.