Order by aggs result will cause nested percentiles return NaN


(五月栞) #1

request:

POST filebeat-6.0.1-2018.11.25/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "1543111691803",
              "lte": "1543112591803",
              "format": "epoch_millis"
            }
          }
        },
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "fileset.module:nginx AND fileset.name:access"
          }
        }
      ]
    }
  },
  "aggs": {
    "4": {
      "terms": {
        "field": "beat.name",
        "size": 2,
        "order": {
          "3[90.0]": "desc"
        },
        "min_doc_count": 1
      },
      "aggs": {
        "3": {
          "percentiles": {
            "field": "nginx.access.upstream_response_time",
            "percents": [
              "90",
              "95",
              "99"
            ]
          }
        },
        "2": {
          "date_histogram": {
            "interval": "2s",
            "field": "@timestamp",
            "min_doc_count": 0,
            "extended_bounds": {
              "min": "1543111691803",
              "max": "1543112591803"
            },
            "format": "epoch_millis"
          },
          "aggs": {
            "1": {
              "percentiles": {
                "field": "nginx.access.upstream_response_time",
                "percents": [
                  "90",
                  "95",
                  "99"
                ]
              }
            }
          }
        }
      }
    }
  }
}

response:

{
  "took": 562,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 453835,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "4": {
      "doc_count_error_upper_bound": -1,
      "sum_other_doc_count": 453736,
      "buckets": [
        {
          "2": {
            "buckets": [
              {
                "1": {
                  "values": {
                    "90.0": "NaN",
                    "95.0": "NaN",
                    "99.0": "NaN"
                  }
                },
                "key_as_string": "1543111690000",
                "key": 1543111690000,
                "doc_count": 0
              },
              ...
            ]
          },
          "3": {
            "values": {
              "90.0": 1.194000005722046,
              "95.0": 1.194000005722046,
              "99.0": 1.194000005722046
            }
          },
          "key": "uat00",
          "doc_count": 1
        },
        {
          "2": {
            "buckets": [...]
          },
          "3": {
            "values": {
              "90.0": 0.16159999817609771,
              "95.0": 0.9663000166416168,
              "99.0": 1.2026199758052827
            }
          },
          "key": "data00",
          "doc_count": 98
        }
      ]
    }
  }
}

We can see the nested percentiles aggs always NaN.

Is there anything wrong with my query? Thanks


(五月栞) #2

Very sorry about it, when I creating the minimal dataset, I found the top data is not enough for date_histogram aggs in 2s interval. So it generates NaN results in most buckets.

Really really sorry about it.