elastic / elasticsearch

Free and Open Source, Distributed, RESTful Search Engine
https://www.elastic.co/products/elasticsearch
Other
690 stars 24.79k forks source link

IllegalArgumentException in DateHistogram (possibly related to field aliases?) #93797

Open not-napoleon opened 1 year ago

not-napoleon commented 1 year ago

Elasticsearch Version

Observed in 8.4 and 8.7; likely impacts other versions

Installed Plugins

n/a

Java Version

bundled

OS Version

Reproed locally on MacOS

Problem Description

Running a simple date histogram over normal looking data with a field alias and lower bound query causes an illegal argument exception in LocalTimeOffset. Reproduces locally for me, with attached script.

  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "[1675375200000] must be <= [-9223372036847575809]"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "index1",
        "node": "yeZJgdNtSMiujrUntAorKw",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "[1675375200000] must be <= [-9223372036847575809]"
        }
      }
    ],
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "[1675375200000] must be <= [-9223372036847575809]",
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "[1675375200000] must be <= [-9223372036847575809]"
      }
    }
  },
  "status": 400
}

Steps to Reproduce

DELETE index1

PUT index1
{
    "mappings": {
        "properties": {
                    "@timestamp": {
          "type": "date"
        },
        "@timestamp_alias": {
          "type": "alias",
          "path": "@timestamp"
        }

        }
    }
}

POST index1/_bulk?refresh
{"index":{"_id":1}}
{"@timestamp": "2023-02-03T10:19:47.885Z"}
{"index":{"_id":2}}
{"@timestamp": "2023-02-03T10:17:10.337Z"}
{"index":{"_id":3}}
{"@timestamp": "2023-02-02T14:51:36.367Z"}

GET index1/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp_alias": {
              "gte": "2023-02-03T00:00:00"
            }
          }
        }
      ]
    }
  }, 
  "aggs": {
    "test": {
      "date_histogram": {
        "field": "@timestamp_alias",
        "calendar_interval": "hour",
        "min_doc_count": 1
      }
    }
  }
}

Logs (if relevant)

No response

elasticsearchmachine commented 1 year ago

Pinging @elastic/es-analytics-geo (Team:Analytics)

not-napoleon commented 1 year ago

Possibly related to https://github.com/elastic/elasticsearch/issues/88131

dej611 commented 6 months ago

Just faced this bug today with a 8.12 deployment with CCS. The CCS response was too big leading to a too_many_buckets_exception, so filters were added to overcome this problem, as Kibana can then collapse by them.

The query was generated by the Kibana Lens visualization tool who uses filters for time shifts within the same request, and additional filters in order to collapse the final result as .

POST /<index>/_search?error_trace=true
{
  "aggs": {
    "0": {
      "filters": {
        "filters": {
          "term1": {
            "bool": {
              "must": [],
              "filter": [
                {
                  "bool": {
                    "should": [
                      {
                        "term": {
                          "region.keyword": {
                            "value": "term1"
                          }
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ],
              "should": [],
              "must_not": []
            }
          },
          "term2": {
            "bool": {
              "must": [],
              "filter": [
                {
                  "bool": {
                    "should": [
                      {
                        "term": {
                          "region.keyword": {
                            "value": "term2"
                          }
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ],
              "should": [],
              "must_not": []
            }
          },
          ... // more filters here
        }
      },
      "aggs": {
        "time_offset_split": {
          "filters": {
            "filters": {
              "0": {
                "range": {
                  "@timestamp": {
                    "format": "strict_date_optional_time",
                    "gte": "2024-04-17T08:53:45.779Z",
                    "lte": "2024-04-17T09:08:45.779Z"
                  }
                }
              },
              "604800000": {
                "range": {
                  "@timestamp": {
                    "format": "strict_date_optional_time",
                    "gte": "2024-04-10T08:53:45.779Z",
                    "lte": "2024-04-10T09:08:45.779Z"
                  }
                }
              },
              "2592000000": {
                "range": {
                  "@timestamp": {
                    "format": "strict_date_optional_time",
                    "gte": "2024-03-17T08:53:45.779Z",
                    "lte": "2024-03-17T09:08:45.779Z"
                  }
                }
              }
            }
          },
          "aggs": {
            "1": {
              "date_histogram": {
                "field": "@timestamp",
                "fixed_interval": "30s",
                "time_zone": "UTC"
              },
              "aggs": {
                "2": {
                  "sum": {
                    "field": "total_field"
                  }
                },
                "3": {
                  "sum": {
                    "field": "total_field"
                  }
                },
                "4": {
                  "sum": {
                    "field": "total_field"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "bool": {
                  "filter": [
                    {
                      "range": {
                        "@timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2024-04-17T08:53:45.779Z",
                          "lte": "2024-04-17T09:08:45.779Z"
                        }
                      }
                    }
                  ]
                }
              },
              {
                "bool": {
                  "filter": [
                    {
                      "range": {
                        "@timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2024-04-10T08:53:45.779Z",
                          "lte": "2024-04-10T09:08:45.779Z"
                        }
                      }
                    }
                  ]
                }
              },
              {
                "bool": {
                  "filter": [
                    {
                      "range": {
                        "@timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2024-03-17T08:53:45.779Z",
                          "lte": "2024-03-17T09:08:45.779Z"
                        }
                      }
                    }
                  ]
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

Notice there are 3 time shifts (one with 0 and 2 with 1w and 1m shifts). Sometimes removing the 3rd time filter seems to not trigger the error, but I've not managed to narrow down to a specific pattern as it happens randomly.