Search Template with float parameters

Elastic Stack Elasticsearch
1

Hello,

I'm trying to build a search template that will return records having a specific field greater or equal to a specific float value. My template looks like this:

POST _search/template/SearchMetricGTE
{
  "template": {
    "size": "{{NumberOfHits}}",
    "query": {
      "bool": {
        "filter": [
          {
            "range": {
              "@timestamp": {
                "gte": "{{DateExpression}}",
                "time_zone": "+00:00"
              }
            }
          },
          {
            "range": {
              "{{PerfmonCounter}}": {
                "gte": "{{PerfmonCounterValue}}"
              }
            }
          }
        ]
      }
    }
  }
}

I'm trying to use it like that:

GET metric_gcs_server/_search/template
{
  "id" : "SearchMetricGTE",
  "params" : {
    "NumberOfHits" : "10",
    "DateExpression" : "now-30m",
    "PerfmonCounter" : "windows.perfmon.CPU Client Service",
    "PerfmonCounterValue" : 0
		  }
}

If PerfmonCounterValue is set with an integer value (as depicted above), everything works as expected. However, if I set it with a float value, 0.25 for example, I receive an error message:

{
  "error": {
    "root_cause": [
      {
        "type": "query_shard_exception",
        "reason": "failed to create query: {\n  \"bool\" : {\n    \"filter\" : [\n      {\n        \"range\" : {\n          \"@timestamp\" : {\n            \"from\" : \"now-30m\",\n            \"to\" : null,\n            \"include_lower\" : true,\n            \"include_upper\" : true,\n            \"time_zone\" : \"UTC\",\n            \"boost\" : 1.0\n          }\n        }\n      },\n      {\n        \"range\" : {\n          \"windows.perfmon.CPU Client Service\" : {\n            \"from\" : \"0.25\",\n            \"to\" : null,\n            \"include_lower\" : true,\n            \"include_upper\" : true,\n            \"boost\" : 1.0\n          }\n        }\n      }\n    ],\n    \"disable_coord\" : false,\n    \"adjust_pure_negative\" : true,\n    \"boost\" : 1.0\n  }\n}",
        "index_uuid": "5cF-ymppQqCpgbMS3KhhzQ",
        "index": "metric_gcs_server"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "metric_gcs_server",
        "node": "D2qWwLwzTzmTbRNm28QLIg",
        "reason": {
          "type": "query_shard_exception",
          "reason": "failed to create query: {\n  \"bool\" : {\n    \"filter\" : [\n      {\n        \"range\" : {\n          \"@timestamp\" : {\n            \"from\" : \"now-30m\",\n            \"to\" : null,\n            \"include_lower\" : true,\n            \"include_upper\" : true,\n            \"time_zone\" : \"UTC\",\n            \"boost\" : 1.0\n          }\n        }\n      },\n      {\n        \"range\" : {\n          \"windows.perfmon.CPU Client Service\" : {\n            \"from\" : \"0.25\",\n            \"to\" : null,\n            \"include_lower\" : true,\n            \"include_upper\" : true,\n            \"boost\" : 1.0\n          }\n        }\n      }\n    ],\n    \"disable_coord\" : false,\n    \"adjust_pure_negative\" : true,\n    \"boost\" : 1.0\n  }\n}",
          "index_uuid": "5cF-ymppQqCpgbMS3KhhzQ",
          "index": "metric_gcs_server",
          "caused_by": {
            "type": "number_format_exception",
            "reason": "For input string: \"0.25\""
          }
        }
      }
    ]
  },
  "status": 400
}

It seems that since my value contains a dot, it gets translated to an string with escaped double quotes and the conversion fails. The examples provided for search template always use integer and I did not find anything with google on this specific use case.

Is it a limitation of the mustache scripting language? Is there a way to make it work?

Thanks,
Pierre-Luc

2

Can you please put the code in code block. It is very hard to read.

3

Added code section for readability.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.