Order by aggs result will cause nested percentiles return NaN

request:

POST filebeat-6.0.1-2018.11.25/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "1543111691803",
              "lte": "1543112591803",
              "format": "epoch_millis"
            }
          }
        },
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "fileset.module:nginx AND fileset.name:access"
          }
        }
      ]
    }
  },
  "aggs": {
    "4": {
      "terms": {
        "field": "beat.name",
        "size": 2,
        "order": {
          "3[90.0]": "desc"
        },
        "min_doc_count": 1
      },
      "aggs": {
        "3": {
          "percentiles": {
            "field": "nginx.access.upstream_response_time",
            "percents": [
              "90",
              "95",
              "99"
            ]
          }
        },
        "2": {
          "date_histogram": {
            "interval": "2s",
            "field": "@timestamp",
            "min_doc_count": 0,
            "extended_bounds": {
              "min": "1543111691803",
              "max": "1543112591803"
            },
            "format": "epoch_millis"
          },
          "aggs": {
            "1": {
              "percentiles": {
                "field": "nginx.access.upstream_response_time",
                "percents": [
                  "90",
                  "95",
                  "99"
                ]
              }
            }
          }
        }
      }
    }
  }
}

response:

{
  "took": 562,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 453835,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "4": {
      "doc_count_error_upper_bound": -1,
      "sum_other_doc_count": 453736,
      "buckets": [
        {
          "2": {
            "buckets": [
              {
                "1": {
                  "values": {
                    "90.0": "NaN",
                    "95.0": "NaN",
                    "99.0": "NaN"
                  }
                },
                "key_as_string": "1543111690000",
                "key": 1543111690000,
                "doc_count": 0
              },
              ...
            ]
          },
          "3": {
            "values": {
              "90.0": 1.194000005722046,
              "95.0": 1.194000005722046,
              "99.0": 1.194000005722046
            }
          },
          "key": "uat00",
          "doc_count": 1
        },
        {
          "2": {
            "buckets": [...]
          },
          "3": {
            "values": {
              "90.0": 0.16159999817609771,
              "95.0": 0.9663000166416168,
              "99.0": 1.2026199758052827
            }
          },
          "key": "data00",
          "doc_count": 98
        }
      ]
    }
  }
}

We can see the nested percentiles aggs always NaN.

Is there anything wrong with my query? Thanks

Very sorry about it, when I creating the minimal dataset, I found the top data is not enough for date_histogram aggs in 2s interval. So it generates NaN results in most buckets.

Really really sorry about it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.