Skip to content

[BUG] Cannot parse the bucket if we optimize a composite to non-composite aggregate #4705

@LantaoJin

Description

@LantaoJin

What is the bug?
Cannot parse the bucket keys if we optimize a composite aggregate to non-composite aggregate

How can one reproduce the bug?

PUT time/
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date",
        "format": "strict_date_optional_time||epoch_millis"
      },
      "timestamp": {
        "type": "date",
        "format": "strict_date_optional_time||epoch_millis"
      },
      "value": {
        "type": "integer"
      },
      "category": {
        "type": "keyword"
      },
      "bool": {
        "type": "boolean"
      }
    }
  }
}

POST time/_bulk
{"index":{"_id":"1"}}
{"timestamp":"2025-07-28T00:15:23","value":8945,"category":"A","@timestamp":"2025-07-28T00:15:23","bool":true}
{"index":{"_id":"2"}}
{"timestamp":"2025-07-28T01:42:15","value":7623,"category":"B","@timestamp":"2025-07-28T01:42:15","bool":true}
{"index":{"_id":"3"}}
{"timestamp":"2025-07-28T02:28:45","value":9187,"category":"C","@timestamp":"2025-07-28T02:28:45","bool":true}
{"index":{"_id":"4"}}
{"timestamp":"2025-07-28T03:56:20","value":6834,"category":"A","@timestamp":"2025-07-28T03:56:20","bool":false}
{"index":{"_id":"5"}}
{"timestamp":"2025-07-28T04:33:10","value":8291,"category":"D","@timestamp":"2025-07-28T04:33:10","bool":true}
{"index":{"_id":"6"}}
{"timestamp":"2025-07-28T05:17:55","value":7456,"category":"B","@timestamp":"2025-07-28T05:17:55"}
{"index":{"_id":"7"}}
{"timestamp":"2025-07-28T06:04:40","value":9012,"category":"C","@timestamp":"2025-07-28T06:04:40"}

Below queries display "null" bucket names

source=time | stats bucket_nullable=false count() by span(value, 1000) | sort - `count()`
source=time | stats bucket_nullable=false count() by span(@timestamp, 1h) | sort - `count()`
source=time | stats bucket_nullable=false count() by value | sort - `count()`
source=time | stats bucket_nullable=false count() by bool | sort - `count()`
source=time | stats bucket_nullable=false count() by category | sort - `count()`

What is the expected behavior?
The bucket keys should not be "null"

What is your host/environment?

  • OS: [e.g. iOS]
  • Version [e.g. 22]
  • Plugins

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
#4400
#4603

Metadata

Metadata

Assignees

Labels

PPLPiped processing languagebugSomething isn't working

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions