Search_phase_execution_exception Caused by: script_exception: compile error, caused by: "compile error,cannot resolve symbol [B]"

[Gelinski (Matheus Gelinski Pires)]

Hello folks,

I am trying to create an Alert Rule of 'Metric threshold' type where I am using the 'custom equation' condition option to calculate a percentage.

The details of the rule are bellow:

Condition
When custom equation is above or equal to 0.05

Aggregations
Aggregation A = Document count of query filter for field A
Aggregation B = Document count of query filter for field B

Equation
A/(A+B)

Even with A and B returning valid values, I got the following error at rule execution:

search_phase_execution_exception Caused by: script_exception: compile error, caused by: "compile error,cannot resolve symbol [B]"

I did a simple test changing the equation to A+B and it works.

Could this be a bug?

Thanks,
Matheus

[simianhacker (Chris Cowan)]

This is a bug... the work around would be to do:

Aggregations
Aggregation A = Document count of query filter for field A
Aggregation B = Document count of query filter for field B
Aggregation C = Document count of query filter for field A

Equation
A/(C+B)

[AO] The custom equation throws 500 when a variable is repeated on both Metric Threshold and Custom Threshold rules