Unable to load pie charts with sub-buckets aggregation after migrating to es/kibana 5.4.0

Hi
Today i migrated my stack to elasticsearch and kibana to 5.4.0, from elasticsearch 2.4.0 and kibana 4.5, now every time i try to create a pie chart with sub-buckets i get the following error:

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"null_pointer_exception","reason":null}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"graylog_240","node":"BZsKa72CQim7i76BsbaGsg","reason":{"type":"null_pointer_exception","reason":null}}]},"status":500}
at http://192.168.0.135:5601/bundles/kibana.bundle.js?v=15063:28:9088
at Function.Promise.try (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:82:22203)
at http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:82:21573
at Array.map (native)
at Function.Promise.map (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:82:21528)
at callResponseHandlers (http://192.168.0.135:5601/bundles/kibana.bundle.js?v=15063:28:8704)
at http://192.168.0.135:5601/bundles/kibana.bundle.js?v=15063:27:28290
at processQueue (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:38:23621)
at http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:38:23888
at Scope.$eval (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:39:4619)

is it common problem? i mean it doesn't look like a user error to me, right? also i have the following message in my es logs:

[2017-05-11T13:19:29,075][WARN ][o.e.d.r.a.RestFieldStatsAction] [_field_stats] endpoint is deprecated! Use [_field_caps] instead or run a min/max aggregations on the desired fields.

EDIT:
i just noticed that problem only occurs when i aggregate by scripted xfer field which looks like this:

doc['sent'].value+doc['rcvd'].value

what i've done wrong?:slight_smile:

Hmm, I'm not exactly sure what's happening, but could you go into your index pattern and try clicking on the "refresh field list" button and see if that helps?

it didn't help, but there is the same message in es logs:

[2017-05-12T06:09:21,486][WARN ][o.e.d.r.a.RestFieldStatsAction] [_field_stats] endpoint is deprecated! Use [_field_caps] instead or run a min/max aggregations on the desired fields.

when refreshing field list

EDIT:
everything works fine after i changed a scripted field type to painless instead of expression

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.