IllegalArgumentException in DateHistogram (possibly related to field aliases?)

Elasticsearch Version

Observed in 8.4 and 8.7; likely impacts other versions

Installed Plugins

n/a

Java Version

bundled

OS Version

Reproed locally on MacOS

Problem Description

Running a simple date histogram over normal looking data with a field alias and lower bound query causes an illegal argument exception in LocalTimeOffset. Reproduces locally for me, with attached script.

  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "[1675375200000] must be <= [-9223372036847575809]"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "index1",
        "node": "yeZJgdNtSMiujrUntAorKw",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "[1675375200000] must be <= [-9223372036847575809]"
        }
      }
    ],
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "[1675375200000] must be <= [-9223372036847575809]",
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "[1675375200000] must be <= [-9223372036847575809]"
      }
    }
  },
  "status": 400
}

Steps to Reproduce

DELETE index1

PUT index1
{
    "mappings": {
        "properties": {
                    "@timestamp": {
          "type": "date"
        },
        "@timestamp_alias": {
          "type": "alias",
          "path": "@timestamp"
        }

        }
    }
}

POST index1/_bulk?refresh
{"index":{"_id":1}}
{"@timestamp": "2023-02-03T10:19:47.885Z"}
{"index":{"_id":2}}
{"@timestamp": "2023-02-03T10:17:10.337Z"}
{"index":{"_id":3}}
{"@timestamp": "2023-02-02T14:51:36.367Z"}

GET index1/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp_alias": {
              "gte": "2023-02-03T00:00:00"
            }
          }
        }
      ]
    }
  }, 
  "aggs": {
    "test": {
      "date_histogram": {
        "field": "@timestamp_alias",
        "calendar_interval": "hour",
        "min_doc_count": 1
      }
    }
  }
}

Logs (if relevant)

No response

Just faced this bug today with a 8.12 deployment with CCS. The CCS response was too big leading to a too_many_buckets_exception, so filters were added to overcome this problem, as Kibana can then collapse by them.

The query was generated by the Kibana Lens visualization tool who uses filters for time shifts within the same request, and additional filters in order to collapse the final result as .

POST /<index>/_search?error_trace=true
{
  "aggs": {
    "0": {
      "filters": {
        "filters": {
          "term1": {
            "bool": {
              "must": [],
              "filter": [
                {
                  "bool": {
                    "should": [
                      {
                        "term": {
                          "region.keyword": {
                            "value": "term1"
                          }
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ],
              "should": [],
              "must_not": []
            }
          },
          "term2": {
            "bool": {
              "must": [],
              "filter": [
                {
                  "bool": {
                    "should": [
                      {
                        "term": {
                          "region.keyword": {
                            "value": "term2"
                          }
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ],
              "should": [],
              "must_not": []
            }
          },
          ... // more filters here
        }
      },
      "aggs": {
        "time_offset_split": {
          "filters": {
            "filters": {
              "0": {
                "range": {
                  "@timestamp": {
                    "format": "strict_date_optional_time",
                    "gte": "2024-04-17T08:53:45.779Z",
                    "lte": "2024-04-17T09:08:45.779Z"
                  }
                }
              },
              "604800000": {
                "range": {
                  "@timestamp": {
                    "format": "strict_date_optional_time",
                    "gte": "2024-04-10T08:53:45.779Z",
                    "lte": "2024-04-10T09:08:45.779Z"
                  }
                }
              },
              "2592000000": {
                "range": {
                  "@timestamp": {
                    "format": "strict_date_optional_time",
                    "gte": "2024-03-17T08:53:45.779Z",
                    "lte": "2024-03-17T09:08:45.779Z"
                  }
                }
              }
            }
          },
          "aggs": {
            "1": {
              "date_histogram": {
                "field": "@timestamp",
                "fixed_interval": "30s",
                "time_zone": "UTC"
              },
              "aggs": {
                "2": {
                  "sum": {
                    "field": "total_field"
                  }
                },
                "3": {
                  "sum": {
                    "field": "total_field"
                  }
                },
                "4": {
                  "sum": {
                    "field": "total_field"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0,
  "fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "bool": {
                  "filter": [
                    {
                      "range": {
                        "@timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2024-04-17T08:53:45.779Z",
                          "lte": "2024-04-17T09:08:45.779Z"
                        }
                      }
                    }
                  ]
                }
              },
              {
                "bool": {
                  "filter": [
                    {
                      "range": {
                        "@timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2024-04-10T08:53:45.779Z",
                          "lte": "2024-04-10T09:08:45.779Z"
                        }
                      }
                    }
                  ]
                }
              },
              {
                "bool": {
                  "filter": [
                    {
                      "range": {
                        "@timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2024-03-17T08:53:45.779Z",
                          "lte": "2024-03-17T09:08:45.779Z"
                        }
                      }
                    }
                  ]
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

Notice there are 3 time shifts (one with 0 and 2 with 1w and 1m shifts). Sometimes removing the 3rd time filter seems to not trigger the error, but I've not managed to narrow down to a specific pattern as it happens randomly.

elastic / elasticsearch