Unable to load pie charts with sub-buckets aggregation after migrating to es/kibana 5.4.0

Elastic Stack Kibana
1

Hi
Today i migrated my stack to elasticsearch and kibana to 5.4.0, from elasticsearch 2.4.0 and kibana 4.5, now every time i try to create a pie chart with sub-buckets i get the following error:

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"null_pointer_exception","reason":null}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"graylog_240","node":"BZsKa72CQim7i76BsbaGsg","reason":{"type":"null_pointer_exception","reason":null}}]},"status":500}
at http://192.168.0.135:5601/bundles/kibana.bundle.js?v=15063:28:9088
at Function.Promise.try (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:82:22203)
at http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:82:21573
at Array.map (native)
at Function.Promise.map (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:82:21528)
at callResponseHandlers (http://192.168.0.135:5601/bundles/kibana.bundle.js?v=15063:28:8704)
at http://192.168.0.135:5601/bundles/kibana.bundle.js?v=15063:27:28290
at processQueue (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:38:23621)
at http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:38:23888
at Scope.$eval (http://192.168.0.135:5601/bundles/commons.bundle.js?v=15063:39:4619)

is it common problem? i mean it doesn't look like a user error to me, right? also i have the following message in my es logs:

[2017-05-11T13:19:29,075][WARN ][o.e.d.r.a.RestFieldStatsAction] [_field_stats] endpoint is deprecated! Use [_field_caps] instead or run a min/max aggregations on the desired fields.

EDIT:
i just noticed that problem only occurs when i aggregate by scripted xfer field which looks like this:

doc['sent'].value+doc['rcvd'].value

what i've done wrong?:slight_smile:

2

Hmm, I'm not exactly sure what's happening, but could you go into your index pattern and try clicking on the "refresh field list" button and see if that helps?

3

it didn't help, but there is the same message in es logs:

[2017-05-12T06:09:21,486][WARN ][o.e.d.r.a.RestFieldStatsAction] [_field_stats] endpoint is deprecated! Use [_field_caps] instead or run a min/max aggregations on the desired fields.

when refreshing field list

EDIT:
everything works fine after i changed a scripted field type to painless instead of expression

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.