Rollup - type [RangeAggregationBuilder] is currently unsupported

[Paul_Ainslie]

Is there a way of rewriting this query so it works on a _rollup_search? It works on the raw index, but I get this error on the rollup index.

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "Unable to translate aggregation tree into Rollup.  Aggregation [my_date_range] is of type [RangeAggregationBuilder] which is currently unsupported."
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "Unable to translate aggregation tree into Rollup.  Aggregation [my_date_range] is of type [RangeAggregationBuilder] which is currently unsupported."
  },
  "status": 400
}

Here's the query:

{
  "size": 0,
  "query": {
    "match_all": {}
  },
  "aggs": {
    "my_date_range": {
      "range": {
        "field": "@timestamp",
         "format": "YYYY-MM-DD",
        "ranges": [
          {
            "from": "2017-09-01"
          },
          {
            "to": "2017-09-30" 
          }
        ]
      },
      "aggs": {
        "total_bytes": {
          "sum": {
            "field": "bytes"
          }
        }
      }
    }
  }
}

[polyfractal (Zachary Tong)]

Hey @Paul_Ainslie, sorry for the delay in responding.

Range aggs aren't supported at the moment. I think we could probably support them with the data we store right now (e.g. just the timestamp buckets), although it may be limited support due to bucket intervals. I've opened an issue to track this request: https://github.com/elastic/elasticsearch/issues/33041

Since you only have one range, you could rewrite it to use a range filter in the query (from 2017-09-01 to 2017-09-30) instead of using the date range aggregation. Then just use a sum aggregation by itself, since the data will be filtered by the query.

[Paul_Ainslie]

Thanks Zachary! I tried the range filter instead of using the date range aggregation and it worked... plus it's way, way faster! That reduced 7 second queries down to 0.2 seconds! Spread the word!

I converted a number of our queries over to range filters until I tried to convert a Sum Bucket Aggregation and then my results were wrong. But I'll post that seperately.