Elasticsearch Metrics integration dashboard error: Field [elasticsearch.ingest_pipeline.total.count] of type [long] is not supported for aggregation [sum].

[bczifra]

The [Elasticsearch] Ingest Pipelines dashboard in the Elasticsearch integration is throwing an error that: Field [elasticsearch.ingest_pipeline.total.count] of type [long] is not supported for aggregation [sum].

• index_mode is set to time_series:

  integrations/packages/elasticsearch/data_stream/ingest_pipeline/manifest.yml

  Line 10 in 3ce066e

  index_mode: "time_series"

• elasticsearch.ingest_pipeline.total.count is a counter field: https://github.com/elastic/integrations/blob/3ce066e4b81169ad068909313e4cc6336c261dd8/packages/elasticsearch/data_stream/ingest_pipeline/fields/fields.yml#L18C17-L18C17
• the dashboard defines a sum aggregation on that field: https://github.com/elastic/integrations/blob/3ce066e4b81169ad068909313e4cc6336c261dd8/packages/elasticsearch/kibana/dashboard/elasticsearch-metrics-ingest-pipelines.json#L584C93-L584C93
• Sum aggregations aren’t available on counter fields: Counter field validation still occurs after downgrading tsdb data stream elasticsearch#96170
• The release is marked experimental:

  integrations/packages/elasticsearch/data_stream/ingest_pipeline/manifest.yml

  Line 4 in 3ce066e

  release: experimental

As a workaround, it's possible to [disable the use of TSDS on the data stream]https://www.elastic.co/guide/en/fleet/current/data-streams-advanced-features.html#data-streams-advanced-tsds-disable).

[joshdover]

Good news here is that I think this can be fixed, but I don't have a cluster to try it on right now.

It seems that the sum agg on these fields is only be used for ranking on the breakdowns, not the actual metrics. I think we can change this to use max instead of sum and get the same result. max is supported on counter fields.

Note that the linked example in https://github.com/elastic/integrations/blob/3ce066e4b81169ad068909313e4cc6336c261dd8/packages/elasticsearch/kibana/dashboard/elasticsearch-metrics-ingest-pipelines.json is not the only one. There are several but they all look to be similar.

[joshdover]

Note that to reproduce this, you have to be using Elastic Agent to monitor Elasticsearch. We do not use TSDS when monitoring with just Beats.

[joshdover]

cc @tylerperk as your team owns this integration

[lalit-satapathy]

The aggregation restrictions on counter fields are being removed and recent fixes has gone from elasticsearch on the same- elastic/elasticsearch#97974

[joshdover]

I can confirm this is fixed on 8.9.1