Graylog2 / Graylog2/graylog2-server
Aggregation Event Definiton query cannot handle different mapping types
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When an aggregation event definition is running a terms aggregation over multiple indices,
you may get an error of `array_index_out_of_bounds_exception`
This is usually caused by two of the indices not
having the same mapping type for the field being aggregated.
In case of a `reason=Index 16 out of bounds for length 16` this query likely involves a field of type `ip`
Exception:
```
ERROR [EventProcessorExecutionJob] Event processor failed to execute: OpenSearch exception [type=array_index_out_of_bounds_exception, reason=Index 16 out of bounds for length 16]. (retry in 5000 ms)
org.graylog.events.processor.EventProcessorException: OpenSearch exception [type=array_index_out_of_bounds_exception, reason=Index 16 out of bounds for length 16].
at org.graylog.events.processor.aggregation.PivotAggregationSearch.doSearch(PivotAggregationSearch.java:153) ~[graylog.jar:?]
```
OpenSearch Exception:
```
[WARN ][r.suppressed] [ip-172-23-7-172.eu-central-1.compute.internal] path: /_msearch, params: {typed_keys=true}
java.lang.ArrayIndexOutOfBoundsException: Index 16 out of bounds for length 16
at org.apache.lucene.util.UnicodeUtil.UTF8toUTF16(UnicodeUtil.java:647) ~[lucene-core-9.7.0.jar:9.7.0 ccf4b198ec328095d45d2746189dc8ca633e8bcf - 2023-06-21 11:48:16]
at org.apache.lucene.util.BytesRef.utf8ToString(BytesRef.java:136) ~[lucene-core-9.7.0.jar:9.7.0 ccf4b198ec328095d45d2746189dc8ca633e8bcf - 2023-06-21 11:48:16]
at org.opensearch.search.DocValueFormat$1.format(DocValueFormat.java:159) ~[opensearch-2.9.0.jar:2.9.0]
at org.opensearch.search.DocValueFormat$1.format(DocValueFormat.java:128) ~[opensearch-2.9.0.jar:2.9.0]
at org.opensearch.search.aggregations.bucket.terms.StringTerms$Bucket.getKeyAsString(StringTerms.java:109) ~[opensearch-2.9.0.jar:2.9.0]
at org.opensearch.search.aggregations.bucket.terms.StringTerms$Bucket.keyToXContent(StringTerms.java:119) ~[opensearch-2.9.0.jar:2.9.0]
```
There is a "fix" in elastic for this which is not in OS. However, It looks like it just change the error to something more meaningful.
https://github.com/elastic/elasticsearch/issues/72040
We'd have to see how we can handle aggregations over conflicting types in event queries.
@Graylog2/search How does the search frontend deal with this?
We probably need to aggregate with `value_type` and `missing` but that depends on the actual type and case.
```
{
"aggs": {
"ip_addresses": {
"terms": {
"field": "destination_ip",
"missing": "0.0.0.0",
"value_type": "ip"
}
}
}
}
```
[ HS #1798847371 ]
* Graylog Version: 5.1.3
* OpenSearch Version: 2.9.0 (but likely any other version)
Contributor guide
Assessment
This issue has not been assessed yet.