response 503, reason: org.elasticsearch.search.aggregations.pipeline.InternalSimpleValue cannot be cast to org.elasticsearch.search.aggregations.InternalMultiBucketAggregation.

[hzjiangjian]

hi, there is an error occured when i try to use "sum_bucket" aggregation. Query body is like:

get /index/type/_search
{
   "query":{
      "bool":{
         "filter":[
            {
               "range":{
                  "time":{
                     "gte":1531365921000,
                     "lte":1531365931000
                  }
               }
            }
         ],
         "must":[
            {
               "match":{
                  "key":"value"
               }
            }
         ]
      }
   },
   "aggs":{
      "vals":{
         "terms":{
            "field":"field1",
            "size":1000
         },
         "aggs":{
            "field2":{
               "sum_bucket":{
                  "buckets_path":"vals>field2"
               }
            },
            "vals":{
               "aggs":{
                  "field2":{
                     "avg":{
                        "field":"field2"
                     }
                  }
               },
               "terms":{
                  "field":"field3"
               }
            }
         }
      }
   },
   "size":0
}

but i get an error response:

'{"error":{"root_cause":[],"type":"search_phase_execution_exception","reason":"","phase":"fetch","grouped":true,"failed_shards":[],"caused_by":{"type":"class_cast_exception","reason":"org.elasticsearch.search.aggregations.pipeline.InternalSimpleValue cannot be cast to org.elasticsearch.search.aggregations.InternalMultiBucketAggregation"}},"status":503}

The version of es is 6.1.3, platform centos6.5.

Can Someone tell me what happened? Thanks!

[elasticmachine]

Pinging @elastic/es-search-aggs

[colings86]

@polyfractal could you take a look at this?

[polyfractal]

Hey @hzjiangjian, sorry for the delay... this fell through my inbox without noticing.

I think you may be running into #30608 (comment), which will be fixed in 6.4 (#30632). Can you try renaming your aggregations/pipeline aggs to use distinct names? Right now your aggregations use the same name several times ("vals", "field2"). The bug I linked is triggered due to repeated names.

[hzjiangjian]

hi @polyfractal, glad to hear from you. I have worked around this issue. You know how I do this?
There are two different data structs in my project, most fields of both are in same datatype. I stored them in different index patterns(like data-a-2018.08.07, data-b-2018.08.07), with date suffix. The problem is i set them with the same alias(data-alias), and i use alias name to do search and aggregation. Maybe my problem(the traceback showed above) is caused by this. When i set different alias for them(data-a-2018.08.07 with data-a-alias, data-b-2018.08.07 with data-b-alias), the problem is solved, with the same aggregation request(just different in alias name). So i think maybe there are some data conflicts between two type of indexes. But i still cannot locate the conflicts.
As you mentioned, use different aggregation names, maybe i can try it later and see what will happen.

[polyfractal]

@hzjiangjian any update? Otherwise I think we can close this, I'm fairly sure it was an instance of #30608 (comment)

[hzjiangjian]

@polyfractal OK. Just close this.