Kibana json aggregration query not working

Elastic Stack Kibana
1

Hi,

I'm trying examples from https://www.elastic.co/guide/en/elasticsearch/reference/current/_executing_aggregations.html to run searches on the banking data.

The below json query works fine when I query elasticsearch using curl, but the same query (minified json format) throws an error in kibana.

Elasticsearch:

{
"size": 0,
"aggs": {
"group_by_state": {
"terms": {
"field": "state"
},
"aggs": {
"average_balance": {
"avg": {
"field": "balance"
}
}
}
}
}
}

Kibana:
{"size":0,"aggs":{"group_by_state":{"terms":{"field":"state"},"aggs":{"average_balance":{"avg":{"field":"balance"}}}}}}

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_parsing_exception","reason":"[_na] query malformed, no field after start_object","index":"logstash-2016.03.11","line":1,"col":283}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logstash-2016.03.11","node":"T0Ga_5wIS16cHgzEQQNZEw","reason":{"type":"query_parsing_exception","reason":"[_na] query malformed, no field after start_object","index":"logstash-2016.03.11","line":1,"col":283}}]}}
at http://10.110.1.144:5601/bundles/kibana.bundle.js:79477:39
at Function.Promise.try (http://10.110.1.144:5601/bundles/commons.bundle.js:60997:23)
at http://10.110.1.144:5601/bundles/commons.bundle.js:60966:31
at Array.map (native)
at Function.Promise.map (http://10.110.1.144:5601/bundles/commons.bundle.js:60965:31)
at callResponseHandlers (http://10.110.1.144:5601/bundles/kibana.bundle.js:79449:23)
at http://10.110.1.144:5601/bundles/kibana.bundle.js:78954:17
at processQueue (http://10.110.1.144:5601/bundles/commons.bundle.js:42358:29)
at http://10.110.1.144:5601/bundles/commons.bundle.js:42374:28
at Scope.$eval (http://10.110.1.144:5601/bundles/commons.bundle.js:43602:29)

Any idea how to fix this?

Thanks,
Siva

2

Where are you attempting to run this JSON? The main search bar? Or in the custom json field of a visualization?

3

In the main search bar.

Thanks,
Siva

4

Ah, that explains it. The search bar doesn't support aggregations, just search queries. If you want to do aggregations, that's what the Visualize tab is for.