Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

_search calls to OpenSearch with terminate_after throw null_pointer_exception. Among others, this makes same visualizations that worked on OpenSearch 2.13 to fail on 2.14 #14198

Closed
franfreire opened this issue May 24, 2024 · 18 comments · Fixed by #14208
Assignees
Labels
bug Something isn't working Search:Aggregations Search Search query, autocomplete ...etc v2.15.0 Issues and PRs related to version 2.15.0

Comments

@franfreire
Copy link

Visualization type: Controls

I had this visualization working in opensearch until I updated to 2.14. I tested it back in opensearch 2.13 and in this version it works properly

Selección_999(471)

When I check opensearch logs I see the following error:

org.opensearch.action.search.SearchPhaseExecutionException: all shards failed
	at org.opensearch.action.search.AbstractSearchAsyncAction.onPhaseFailure(AbstractSearchAsyncAction.java:757) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:394) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.search.AbstractSearchAsyncAction.onPhaseDone(AbstractSearchAsyncAction.java:796) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.search.AbstractSearchAsyncAction.onShardFailure(AbstractSearchAsyncAction.java:542) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.search.AbstractSearchAsyncAction$1.onFailure(AbstractSearchAsyncAction.java:315) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.search.SearchExecutionStatsCollector.onFailure(SearchExecutionStatsCollector.java:104) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.ActionListenerResponseHandler.handleException(ActionListenerResponseHandler.java:75) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.search.SearchTransportService$ConnectionCountingHandler.handleException(SearchTransportService.java:766) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.transport.TransportService$9.handleException(TransportService.java:1729) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.security.transport.SecurityInterceptor$RestoringTransportResponseHandler.handleException(SecurityInterceptor.java:410) [opensearch-security-2.14.0.0.jar:2.14.0.0]
	at org.opensearch.transport.TransportService$ContextRestoreResponseHandler.handleException(TransportService.java:1515) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.transport.TransportService$DirectResponseChannel.processException(TransportService.java:1629) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:1603) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.transport.TaskTransportChannel.sendResponse(TaskTransportChannel.java:81) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.transport.TransportChannel.sendErrorResponse(TransportChannel.java:75) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.support.ChannelActionListener.onFailure(ChannelActionListener.java:70) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.ActionRunnable.onFailure(ActionRunnable.java:104) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:54) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:913) [opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.14.0.jar:2.14.0]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
Caused by: org.opensearch.OpenSearchException$3: Cannot invoke "org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()" because "namedWriteable" is null
	at org.opensearch.OpenSearchException.guessRootCauses(OpenSearchException.java:710) ~[opensearch-core-2.14.0.jar:2.14.0]
	at org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:392) [opensearch-2.14.0.jar:2.14.0]
	... 24 more
Caused by: java.lang.NullPointerException: Cannot invoke "org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()" because "namedWriteable" is null
	at org.opensearch.core.common.io.stream.StreamOutput.writeNamedWriteable(StreamOutput.java:1134) ~[opensearch-core-2.14.0.jar:2.14.0]
	at org.opensearch.core.common.io.stream.StreamOutput.writeNamedWriteableList(StreamOutput.java:1233) ~[opensearch-core-2.14.0.jar:2.14.0]
	at org.opensearch.search.aggregations.InternalAggregations.writeTo(InternalAggregations.java:154) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.io.stream.DelayableWriteable$Referencing.writeToBuffer(DelayableWriteable.java:147) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.io.stream.DelayableWriteable$Referencing.writeTo(DelayableWriteable.java:120) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.search.query.QuerySearchResult.writeToNoId(QuerySearchResult.java:445) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.cache.policy.CachedQueryResult.writeToNoId(CachedQueryResult.java:60) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.indices.IndicesService.lambda$loadIntoContext$24(IndicesService.java:1707) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.indices.IndicesService.lambda$cacheShardLevelResult$25(IndicesService.java:1764) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.indices.IndicesRequestCache$Loader.load(IndicesRequestCache.java:345) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.indices.IndicesRequestCache$Loader.load(IndicesRequestCache.java:328) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.cache.store.OpenSearchOnHeapCache.lambda$computeIfAbsent$0(OpenSearchOnHeapCache.java:98) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.cache.Cache.compute(Cache.java:470) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.cache.Cache.computeIfAbsent(Cache.java:427) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.cache.store.OpenSearchOnHeapCache.computeIfAbsent(OpenSearchOnHeapCache.java:98) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.indices.IndicesRequestCache.getOrCompute(IndicesRequestCache.java:287) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.indices.IndicesService.cacheShardLevelResult(IndicesService.java:1770) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.indices.IndicesService.loadIntoContext(IndicesService.java:1701) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:557) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.search.SearchService.executeQueryPhase(SearchService.java:623) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.search.SearchService$2.lambda$onResponse$0(SearchService.java:592) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) ~[opensearch-2.14.0.jar:2.14.0]
	at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) ~[opensearch-2.14.0.jar:2.14.0]
	... 8 more

OpenSearch Version
2.14

Dashboards Version
2.14

@franfreire franfreire added bug Something isn't working untriaged labels May 24, 2024
@mjakob-gh
Copy link

mjakob-gh commented May 27, 2024

I am seeing the same error with 2.14, the visualization worked fine with 2.13

I see this notification:
image

in the details is this information

Request:

{
  "timeout": "1000ms",
  "terminate_after": 100000,
  "size": 0,
  "aggs": {
    "termsAgg": {
      "terms": {
        "order": {
          "_count": "desc"
        },
        "field": "fields.umgebung.keyword"
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [],
      "should": [],
      "must_not": []
    }
  }
}

Response (removed all but two mentioned indices, so the numbers dont match):

{
  "took": 38,
  "timed_out": false,
  "terminated_early": false,
  "_shards": {
    "total": 110,
    "successful": 53,
    "skipped": 0,
    "failed": 57,
    "failures": [
      {
        "shard": 0,
        "index": "filebeat-kmewo-prodo-7.12.1-2024.05.06",
        "node": "7VUNjvDMSoSWpgKVDlGTiA",
        "reason": {
          "type": "null_pointer_exception",
          "reason": "Cannot invoke \"org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()\" because \"namedWriteable\" is null"
        }
      },
      {
        "shard": 0,
        "index": "filebeat-kmewo-prodo-7.12.1-2024.05.07",
        "node": "7VUNjvDMSoSWpgKVDlGTiA",
        "reason": {
          "type": "null_pointer_exception",
          "reason": "Cannot invoke \"org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()\" because \"namedWriteable\" is null"
        }
      }
    ]
  },
  "hits": {
    "total": 1831452,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "termsAgg": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "qso",
          "doc_count": 897627
        },
        {
          "key": "prodo",
          "doc_count": 504180
        },
        {
          "key": "sem",
          "doc_count": 238448
        },
        {
          "key": "prodw",
          "doc_count": 119040
        },
        {
          "key": "qsw",
          "doc_count": 72157
        }
      ]
    }
  }
}

@kavilla
Copy link
Member

kavilla commented May 28, 2024

@AMoo-Miki are you able to check on this.

@kavilla
Copy link
Member

kavilla commented May 28, 2024

@franfreire could you please provide information on your indices and any configurations within OpenSearch and OpenSearch Dashboards. Also your local setup?

Thank you.

@yujin-emma yujin-emma self-assigned this May 28, 2024
@disaster37
Copy link

disaster37 commented May 30, 2024

Hi, it's the same here.
I have remove the control visu, The dashboard work fine. If I add it, it work, but I gest the same shard failed pop describe above

@AMoo-Miki
Copy link

@disaster37, I am assuming you and @franfreire are together or the same person. If so and you have ascertained that the issue is caused by a call Controls viz is triggering, I would recommend looking at the Network tab of your browser's DevTools to see what specific query was run to cause this failure.

@mjakob-gh, it would be great if you could provide some info about what the underlying failure is by checking Dev Tools too.

On the surface, both of your errors are directly arriving from OpenSearch and I want to make sure we get more info while we transfer it there.

@AMoo-Miki
Copy link

@opensearch-project/admin please transfer to OpenSearch engine.

@gaiksaya gaiksaya transferred this issue from opensearch-project/OpenSearch-Dashboards Jun 4, 2024
@disaster37
Copy link

I have the same issue than @franfreire but we are not the same person and we are not working on same organization. I will try to grab more useful trace on devtools like you suggest tomorrow.

@rasituum
Copy link

rasituum commented Jun 5, 2024

Hi, i have the same issue on 2.14 with Controls viz, with exactly the same stack traces than @franfreire on my opensearch client node. Works fine in 2.13.

@disaster37
Copy link

@AMoo-Miki I desn't understand what you need exactly ? I have look up on Chrom devtools, but I doesn't found more info than is already provided before by another people.

I have doing some test on fresh cluster install with Opensearch 2.14.0. It is not so easy to reproduce issue.

First, I create Index template (with data stream option) and some components templates linked for mapping.
Then I start indexation with Logstash that will create my data stream index logs-log-default.
I create second index with one document called logs-test with devtools.
I create new index pattern from Opensearch Dashboard called logs-*. So it match my 2 indexes (logs-log-default and logs-test).

Now I go to visualize and I create default control visu on my logs-*. At this time, all work fine. But after few time, when they are many doc indexed by logstash, it's start to no more working and I get the error describe by this issue. My current datastream index is not yet rolleover by ISM. So, ISM seem not be enter in the game.

Now, If create new index pattern logs-log-* that match only one index (logs-log-default). And I use it on Control visu, all work fine. It's the same if I remove the index logs-test (the logs-* now match only one index).

To conclude, the problem seems appear when the index-pattern target multiple index and there are many document indexed on it and I try to create visu of type Controle.

@peternied
Copy link
Member

[Triage - attendees 1 2 3 4 5 6 7]
@opensearch-project/admin Could you please transfer this to the Dashboards repostiory?

@gaiksaya gaiksaya transferred this issue from opensearch-project/OpenSearch Jun 5, 2024
@mjakob-gh
Copy link

I too have many indices matching a index pattern. I do not see errors in the opensearch and opensearch-dashboard logs.
I am not familiar with the browser devtools, so maybe i am missing something, but there is also no error there.

@maaaax
Copy link

maaaax commented Jun 11, 2024

Same here.
~100 minutes ago works, 110 not.
But also a duration of several days in the past, like May 20 to May 25 works. Some durations work, others not.

Our Control-Vis has 1 Control reading from a tiny index (only 10 docs), which always works.
The non-working index is on SSD having 80 million docs. There doesn't seem to a problem with cpu, mem or network.

The cluster metrics (heap used, indexing pressure, index time, threadpool write queue, system load) haven't changed from 2.13 to 2.14.

@disaster37
Copy link

disaster37 commented Jun 11, 2024

Hum, after investigating a little more, maybee I found somethink.

If I Take the query send to Opensearch by dashboard on devtools, I get the same error

GET _search
{
  "timeout": "3000ms",
  "terminate_after": 1000000,
  "size": 0,
  "aggs": {
    "termsAgg": {
      "terms": {
        "order": {
          "_count": "desc"
        },
        "size": 998,
        "field": "labels.application"
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "azure.enqueued_time",
      "format": "date_time"
    },
    {
      "field": "code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "dll.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "event.created",
      "format": "date_time"
    },
    {
      "field": "event.end",
      "format": "date_time"
    },
    {
      "field": "event.ingested",
      "format": "date_time"
    },
    {
      "field": "event.start",
      "format": "date_time"
    },
    {
      "field": "file.accessed",
      "format": "date_time"
    },
    {
      "field": "file.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "file.created",
      "format": "date_time"
    },
    {
      "field": "file.ctime",
      "format": "date_time"
    },
    {
      "field": "file.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "file.mtime",
      "format": "date_time"
    },
    {
      "field": "file.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "file.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "hm.asset.created",
      "format": "date_time"
    },
    {
      "field": "hm.asset.updated",
      "format": "date_time"
    },
    {
      "field": "hm.springbatch.job.end_time",
      "format": "date_time"
    },
    {
      "field": "hm.springbatch.job.start_time",
      "format": "date_time"
    },
    {
      "field": "hm.springbatch.step.start_time",
      "format": "date_time"
    },
    {
      "field": "hm.trace.centralizer_timestamp",
      "format": "date_time"
    },
    {
      "field": "kafka.block_timestamp",
      "format": "date_time"
    },
    {
      "field": "package.installed",
      "format": "date_time"
    },
    {
      "field": "pensando.dfw.timestamp",
      "format": "date_time"
    },
    {
      "field": "postgresql.log.session_start_time",
      "format": "date_time"
    },
    {
      "field": "process.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "process.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "process.end",
      "format": "date_time"
    },
    {
      "field": "process.parent.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "process.parent.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "process.parent.end",
      "format": "date_time"
    },
    {
      "field": "process.parent.start",
      "format": "date_time"
    },
    {
      "field": "process.start",
      "format": "date_time"
    },
    {
      "field": "request_time",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.accessed",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.created",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.ctime",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.mtime",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.first_seen",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.last_seen",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.modified_at",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.accessed",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.created",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.ctime",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.mtime",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.first_seen",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.last_seen",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.modified_at",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.client.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.client.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.client.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.client.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.server.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.server.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.server.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.server.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "winlog.time_created",
      "format": "date_time"
    },
    {
      "field": "x509.not_after",
      "format": "date_time"
    },
    {
      "field": "x509.not_before",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_phrase": {
            "event.module": "undertow"
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

I get errors

{
  "took": 159,
  "timed_out": false,
  "terminated_early": false,
  "_shards": {
    "total": 53,
    "successful": 41,
    "skipped": 0,
    "failed": 12,
    "failures": [
      {
        "shard": 0,
        "index": ".ds-logs-log-default-000007",
        "node": "mJcvNL1VQoWmg2BGiHPE8w",
        "reason": {
          "type": "null_pointer_exception",
          "reason": """Cannot invoke "org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()" because "namedWriteable" is null"""
        }
      },
      {
        "shard": 0,
        "index": ".ds-logs-log-default-000008",
        "node": "mJcvNL1VQoWmg2BGiHPE8w",
        "reason": {
          "type": "null_pointer_exception",
          "reason": """Cannot invoke "org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()" because "namedWriteable" is null"""
        }
      },
      {
        "shard": 0,
        "index": ".ds-logs-log-default-000009",
        "node": "gV7ZtXj2QC642phT9tLD0Q",
        "reason": {
          "type": "null_pointer_exception",
          "reason": """Cannot invoke "org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()" because "namedWriteable" is null"""
        }
      },
      {
        "shard": 0,
        "index": ".ds-logs-log-default-000010",
        "node": "CurNcFBnRpSS3DSJqs557Q",
        "reason": {
          "type": "null_pointer_exception",
          "reason": """Cannot invoke "org.opensearch.core.common.io.stream.NamedWriteable.getWriteableName()" because "namedWriteable" is null"""
        }
      }
    ]
  },
  "hits": {
    "total": {
      "value": 10000,
      "relation": "gte"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "termsAgg": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "apiclient-pp-api",
          "doc_count": 846013
        },
        {
          "key": "avise-api",
          "doc_count": 355173
        },
        {
          "key": "apiclient-interaction-api",
          "doc_count": 289763
        },
        {
          "key": "apiclient-orgacollab-api",
          "doc_count": 198420
        },
        {
          "key": "apiclient-pm-api",
          "doc_count": 173864
        },
        {
          "key": "external-adherent-api",
          "doc_count": 148839
        },
        {
          "key": "tempo-api",
          "doc_count": 91109
        },
        {
          "key": "maestro-api",
          "doc_count": 61486
        },
        {
          "key": "apiclient-consentement-api",
          "doc_count": 56572
        },
        {
          "key": "contralto-coll-api",
          "doc_count": 50583
        },
        {
          "key": "autobots-api",
          "doc_count": 46201
        },
        {
          "key": "soprano-produit-api",
          "doc_count": 45990
        },
        {
          "key": "acdc-backend-api",
          "doc_count": 40979
        },
        {
          "key": "atc-api",
          "doc_count": 37466
        },
        {
          "key": "acdc-admin-api",
          "doc_count": 34188
        },
        {
          "key": "API_CALENDRIER",
          "doc_count": 22356
        },
        {
          "key": "traceo-batch",
          "doc_count": 21622
        },
        {
          "key": "acdc-backend-datalab-api",
          "doc_count": 21089
        },
        {
          "key": "apidatahub-configuration-rd-api",
          "doc_count": 20633
        },
        {
          "key": "gps-api",
          "doc_count": 18248
        },
        {
          "key": "addagio-api",
          "doc_count": 12273
        },
        {
          "key": "hmdrive-consultation-api",
          "doc_count": 11817
        },
        {
          "key": "demande-service-api",
          "doc_count": 11542
        },
        {
          "key": "symphonie-conseil-simtar-api",
          "doc_count": 8222
        },
        {
          "key": "edition-document-api",
          "doc_count": 7941
        },
        {
          "key": "contralto-coll-back-api",
          "doc_count": 7415
        },
        {
          "key": "hmdrive-recherche-api",
          "doc_count": 7214
        },
        {
          "key": "svi-intelligent-api",
          "doc_count": 6708
        },
        {
          "key": "tabgar-tabref-api",
          "doc_count": 6663
        },
        {
          "key": "hapiour-entreprise-api",
          "doc_count": 6137
        },
        {
          "key": "irma-api",
          "doc_count": 6110
        },
        {
          "key": "apisante-api",
          "doc_count": 6028
        },
        {
          "key": "acps-injection-batch",
          "doc_count": 6006
        },
        {
          "key": "apiclient-listevaleur-api",
          "doc_count": 3849
        },
        {
          "key": "rondo-api",
          "doc_count": 3732
        },
        {
          "key": "extranet-ps-api",
          "doc_count": 3469
        },
        {
          "key": "ccm-precom-batch",
          "doc_count": 3391
        },
        {
          "key": "referentiel-relations-partenaires-xp-api",
          "doc_count": 3235
        },
        {
          "key": "datahub-np6-batch",
          "doc_count": 3201
        },
        {
          "key": "hapiour-mutcim-api",
          "doc_count": 3077
        },
        {
          "key": "apidatahub-relation-partenaires-rd-api",
          "doc_count": 3053
        },
        {
          "key": "acdc-affiliation-api",
          "doc_count": 2755
        },
        {
          "key": "hapiour-inscription-api",
          "doc_count": 2039
        },
        {
          "key": "apigps-api",
          "doc_count": 1804
        },
        {
          "key": "hmdrive-injection-api",
          "doc_count": 1648
        },
        {
          "key": "hmdrive-explorer-api",
          "doc_count": 1335
        },
        {
          "key": "HMDRIVE",
          "doc_count": 1316
        },
        {
          "key": "pay-paiement-api",
          "doc_count": 1316
        },
        {
          "key": "apiclient-marketing-api",
          "doc_count": 1229
        },
        {
          "key": "ccm-wellcom-api",
          "doc_count": 1004
        },
        {
          "key": "contacts-api",
          "doc_count": 923
        },
        {
          "key": "presto-api",
          "doc_count": 909
        },
        {
          "key": "infinite-ccm-poi-batch",
          "doc_count": 764
        },
        {
          "key": "acdc-demat-batch",
          "doc_count": 732
        },
        {
          "key": "coconut-api",
          "doc_count": 590
        },
        {
          "key": "octopus-api",
          "doc_count": 579
        },
        {
          "key": "sae-interactions-batch",
          "doc_count": 577
        },
        {
          "key": "hapiend-luke-api",
          "doc_count": 421
        },
        {
          "key": "dsn-portail-api",
          "doc_count": 413
        },
        {
          "key": "signature-api",
          "doc_count": 393
        },
        {
          "key": "BENDER",
          "doc_count": 380
        },
        {
          "key": "svi-intelligent-kie-server-api",
          "doc_count": 379
        },
        {
          "key": "flowsentry-batch",
          "doc_count": 325
        },
        {
          "key": "symphonie-rest-to-wsdl-api",
          "doc_count": 316
        },
        {
          "key": "apidatahub-sante-rd-api",
          "doc_count": 300
        },
        {
          "key": "hapiend-validation-iban-xp-api",
          "doc_count": 299
        },
        {
          "key": "ostinato-xp-api",
          "doc_count": 297
        },
        {
          "key": "JARVIS",
          "doc_count": 296
        },
        {
          "key": "ostinato-rs-api",
          "doc_count": 295
        },
        {
          "key": "acdc-demandes-bonita-proxy-rs-api",
          "doc_count": 293
        },
        {
          "key": "acdc-demande-rp-api",
          "doc_count": 292
        },
        {
          "key": "acdc-demande-delegataire-gestion-rp-api",
          "doc_count": 287
        },
        {
          "key": "datahub-interaction-delegataire-gestion-stream",
          "doc_count": 287
        },
        {
          "key": "apidatahub-frais-chargement-rd-api",
          "doc_count": 286
        },
        {
          "key": "avise-delegataire-gestion-xp-api",
          "doc_count": 284
        },
        {
          "key": "ccm-transco-sefas-batch",
          "doc_count": 281
        },
        {
          "key": "apidatahub-delegataire-gestion-rd-api",
          "doc_count": 272
        },
        {
          "key": "apidatahub-interaction-refps-rd-api",
          "doc_count": 259
        },
        {
          "key": "acdc-demande-ga-rp-api",
          "doc_count": 257
        },
        {
          "key": "avise-frais-chargement-xp-api",
          "doc_count": 255
        },
        {
          "key": "fcc-calcul-taux-rs-api",
          "doc_count": 255
        },
        {
          "key": "parhelie-socle-batch",
          "doc_count": 243
        },
        {
          "key": "apidatahub-donnees-ref-rd-api",
          "doc_count": 238
        },
        {
          "key": "datahub-delegataire-gestion-stream",
          "doc_count": 233
        },
        {
          "key": "apiclient-interaction-jms-api",
          "doc_count": 229
        },
        {
          "key": "hmdrive-admin-api",
          "doc_count": 226
        },
        {
          "key": "hapiour-consentement-std-api",
          "doc_count": 225
        },
        {
          "key": "hadel-traitement-flux-rp-api",
          "doc_count": 223
        },
        {
          "key": "decibel-cr-corrige-api",
          "doc_count": 218
        },
        {
          "key": "robot-api",
          "doc_count": 218
        },
        {
          "key": "hapiend-adhinfo-api",
          "doc_count": 212
        },
        {
          "key": "pacifique-socle-batch",
          "doc_count": 201
        },
        {
          "key": "soprano-tarifer-xp-api",
          "doc_count": 201
        },
        {
          "key": "fcc-notification-stream",
          "doc_count": 195
        },
        {
          "key": "refps-demande-rp-api",
          "doc_count": 194
        },
        {
          "key": "boreal-api",
          "doc_count": 184
        },
        {
          "key": "traceo-api",
          "doc_count": 178
        },
        {
          "key": "apidatahub-lien-compte-utilisateur-rd-api",
          "doc_count": 177
        },
        {
          "key": "apidatahub-interaction-delegataire-gestion-rd-api",
          "doc_count": 172
        },
        {
          "key": "apidatahub-eligibilite-rs-api",
          "doc_count": 167
        },
        {
          "key": "formalites-medicales-rs-api",
          "doc_count": 165
        },
        {
          "key": "ccm-compo-api",
          "doc_count": 164
        },
        {
          "key": "hapiour-due-api",
          "doc_count": 164
        },
        {
          "key": "avise-support-xp-api",
          "doc_count": 159
        },
        {
          "key": "datahub-admin-api",
          "doc_count": 155
        },
        {
          "key": "ccm-preference-demat-api",
          "doc_count": 154
        },
        {
          "key": "relations-partenaires-mise-en-gestion-batch",
          "doc_count": 152
        },
        {
          "key": "maestro-np6-batch",
          "doc_count": 151
        },
        {
          "key": "austral-api",
          "doc_count": 149
        },
        {
          "key": "ccm-configuration-api",
          "doc_count": 144
        },
        {
          "key": "datahub-kafka-sid-batch",
          "doc_count": 141
        },
        {
          "key": "datahub-consentement-batch",
          "doc_count": 140
        },
        {
          "key": "cameleon-flux-tarification-api",
          "doc_count": 138
        },
        {
          "key": "hapiour-consentement-std-batch",
          "doc_count": 137
        },
        {
          "key": "ccm-preference-demat-batch",
          "doc_count": 124
        },
        {
          "key": "apiclient-consentement-jms-api",
          "doc_count": 123
        },
        {
          "key": "ermes-api",
          "doc_count": 122
        },
        {
          "key": "cameleon-flux-configuration-api",
          "doc_count": 117
        },
        {
          "key": "octopus-supervision-rs-api",
          "doc_count": 116
        },
        {
          "key": "hapiend-eligibilite-xp-api",
          "doc_count": 111
        },
        {
          "key": "octopus-task-batch",
          "doc_count": 111
        },
        {
          "key": "hapiend-apicontact-xp-api",
          "doc_count": 108
        },
        {
          "key": "datahub-sid-batch",
          "doc_count": 106
        },
        {
          "key": "infinite-ccm-poi-pecdevi-batch",
          "doc_count": 98
        },
        {
          "key": "hapiend-simtar-xp-api",
          "doc_count": 95
        },
        {
          "key": "hadel-integration-flux-batch",
          "doc_count": 90
        },
        {
          "key": "soprano-renouvellement-tarification-indiv-batch",
          "doc_count": 85
        },
        {
          "key": "datahub-screening-batch",
          "doc_count": 80
        },
        {
          "key": "datahub-fusion-pp-batch",
          "doc_count": 78
        },
        {
          "key": "hapiend-formalites-medicales-xp-api",
          "doc_count": 76
        },
        {
          "key": "hapiend-incoming-gateway-api",
          "doc_count": 76
        },
        {
          "key": "cameleon-flux-edition-api",
          "doc_count": 75
        },
        {
          "key": "sae-demandes-indexation-api",
          "doc_count": 74
        },
        {
          "key": "datahub-ccm-batch",
          "doc_count": 73
        },
        {
          "key": "octopus-automatisation-xp-api",
          "doc_count": 70
        },
        {
          "key": "datahub-inpi-batch",
          "doc_count": 68
        },
        {
          "key": "octopus-kafka-rs-api",
          "doc_count": 66
        },
        {
          "key": "beryl-batch",
          "doc_count": 62
        },
        {
          "key": "metaux-interface-comptable-batch",
          "doc_count": 61
        },
        {
          "key": "datahub-datalab-batch",
          "doc_count": 60
        },
        {
          "key": "ccm-publipostage-api",
          "doc_count": 59
        },
        {
          "key": "meridional-xp-api",
          "doc_count": 59
        },
        {
          "key": "pacifique-socle-dno-batch",
          "doc_count": 56
        },
        {
          "key": "datahub-orgacollab-batch",
          "doc_count": 55
        },
        {
          "key": "datahub-sirene-batch",
          "doc_count": 55
        },
        {
          "key": "hapiend-vivoptim-xp-api",
          "doc_count": 55
        },
        {
          "key": "datahub-interaction-batch",
          "doc_count": 53
        },
        {
          "key": "BERYL",
          "doc_count": 52
        },
        {
          "key": "hapiour-exapi-api",
          "doc_count": 49
        },
        {
          "key": "sae-demandes-demat-batch",
          "doc_count": 43
        },
        {
          "key": "acdc-demandes-stream",
          "doc_count": 42
        },
        {
          "key": "sae-webarchive-api",
          "doc_count": 39
        },
        {
          "key": "soprano-calcul-tarification-offre-batch",
          "doc_count": 33
        },
        {
          "key": "HEXAGONE",
          "doc_count": 32
        },
        {
          "key": "octopus-kafka-batch",
          "doc_count": 32
        },
        {
          "key": "paraselene-socle-batch",
          "doc_count": 30
        },
        {
          "key": "beryl-api",
          "doc_count": 29
        },
        {
          "key": "datahome-isengard-batch",
          "doc_count": 29
        },
        {
          "key": "pacifique-import-vega-batch",
          "doc_count": 27
        },
        {
          "key": "metaux-exportdata-batch",
          "doc_count": 26
        },
        {
          "key": "soprano-integration-fichiers-batch",
          "doc_count": 26
        },
        {
          "key": "metaux-securisation-treso-batch",
          "doc_count": 25
        },
        {
          "key": "pacifique-export-coda-batch",
          "doc_count": 24
        },
        {
          "key": "FLOWSENTRY",
          "doc_count": 23
        },
        {
          "key": "pacifique-import-sapfc-batch",
          "doc_count": 22
        },
        {
          "key": "outgoing-gateway-api",
          "doc_count": 19
        },
        {
          "key": "pacifique-export-sapfc-batch",
          "doc_count": 19
        },
        {
          "key": "external-entreprise-api",
          "doc_count": 18
        },
        {
          "key": "pacifique-export-mind-batch",
          "doc_count": 18
        },
        {
          "key": "pacifique-export-metaux-batch",
          "doc_count": 17
        },
        {
          "key": "pacifique-export-vega-batch",
          "doc_count": 17
        },
        {
          "key": "shift-viamedis-api",
          "doc_count": 15
        },
        {
          "key": "ccm-publipostage-batch",
          "doc_count": 14
        },
        {
          "key": "seed-springboot-back",
          "doc_count": 14
        },
        {
          "key": "cameleon-cart-lines-purge-batch",
          "doc_count": 13
        },
        {
          "key": "pacifique-export-jump-batch",
          "doc_count": 13
        },
        {
          "key": "edition-aiguillage-api",
          "doc_count": 10
        },
        {
          "key": "datahome-hercules-conversion-batch",
          "doc_count": 9
        },
        {
          "key": "infinite-ccm-poi-ca-batch",
          "doc_count": 9
        },
        {
          "key": "pacifique-import-jump-batch",
          "doc_count": 9
        },
        {
          "key": "pacifique-import-mind-batch",
          "doc_count": 9
        },
        {
          "key": "sae-alim-inter-batch",
          "doc_count": 6
        }
      ]
    }
  }
}

Now, If I removed the `"terminate_after": 1000000``from the query, no more error (Or If I put a very big value on it like "terminate_after": 1000000000)

GET _search
{
  "timeout": "3000ms",
  "size": 0,
  "aggs": {
    "termsAgg": {
      "terms": {
        "order": {
          "_count": "desc"
        },
        "size": 998,
        "field": "labels.application"
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "azure.enqueued_time",
      "format": "date_time"
    },
    {
      "field": "code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "dll.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "event.created",
      "format": "date_time"
    },
    {
      "field": "event.end",
      "format": "date_time"
    },
    {
      "field": "event.ingested",
      "format": "date_time"
    },
    {
      "field": "event.start",
      "format": "date_time"
    },
    {
      "field": "file.accessed",
      "format": "date_time"
    },
    {
      "field": "file.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "file.created",
      "format": "date_time"
    },
    {
      "field": "file.ctime",
      "format": "date_time"
    },
    {
      "field": "file.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "file.mtime",
      "format": "date_time"
    },
    {
      "field": "file.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "file.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "hm.asset.created",
      "format": "date_time"
    },
    {
      "field": "hm.asset.updated",
      "format": "date_time"
    },
    {
      "field": "hm.springbatch.job.end_time",
      "format": "date_time"
    },
    {
      "field": "hm.springbatch.job.start_time",
      "format": "date_time"
    },
    {
      "field": "hm.springbatch.step.start_time",
      "format": "date_time"
    },
    {
      "field": "hm.trace.centralizer_timestamp",
      "format": "date_time"
    },
    {
      "field": "kafka.block_timestamp",
      "format": "date_time"
    },
    {
      "field": "package.installed",
      "format": "date_time"
    },
    {
      "field": "pensando.dfw.timestamp",
      "format": "date_time"
    },
    {
      "field": "postgresql.log.session_start_time",
      "format": "date_time"
    },
    {
      "field": "process.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "process.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "process.end",
      "format": "date_time"
    },
    {
      "field": "process.parent.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "process.parent.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "process.parent.end",
      "format": "date_time"
    },
    {
      "field": "process.parent.start",
      "format": "date_time"
    },
    {
      "field": "process.start",
      "format": "date_time"
    },
    {
      "field": "request_time",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.accessed",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.created",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.ctime",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.file.mtime",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.first_seen",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.last_seen",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.modified_at",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "threat.enrichments.indicator.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.accessed",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.code_signature.timestamp",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.created",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.ctime",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.elf.creation_date",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.file.mtime",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.first_seen",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.last_seen",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.modified_at",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "threat.indicator.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.client.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.client.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.client.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.client.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.server.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.server.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.server.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.server.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "winlog.time_created",
      "format": "date_time"
    },
    {
      "field": "x509.not_after",
      "format": "date_time"
    },
    {
      "field": "x509.not_before",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_phrase": {
            "event.module": "undertow"
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

I get the expected result

{
  "took": 52,
  "timed_out": false,
  "_shards": {
    "total": 53,
    "successful": 53,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 10000,
      "relation": "gte"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "termsAgg": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "apiclient-pp-api",
          "doc_count": 19804154
        },
        {
          "key": "avise-api",
          "doc_count": 8028522
        },
        {
          "key": "apiclient-interaction-api",
          "doc_count": 7947500
        },
        {
          "key": "external-adherent-api",
          "doc_count": 4937238
        },
        {
          "key": "apiclient-orgacollab-api",
          "doc_count": 4763396
        },
        {
          "key": "apiclient-pm-api",
          "doc_count": 3602962
        },
        {
          "key": "traceo-batch",
          "doc_count": 2035456
        },
        {
          "key": "acdc-backend-api",
          "doc_count": 1702825
        },
        {
          "key": "autobots-api",
          "doc_count": 1553308
        },
        {
          "key": "tempo-api",
          "doc_count": 1521048
        },
        {
          "key": "apiclient-consentement-api",
          "doc_count": 1459056
        },
        {
          "key": "maestro-api",
          "doc_count": 1377672
        },
        {
          "key": "atc-api",
          "doc_count": 1344816
        },
        {
          "key": "contralto-coll-api",
          "doc_count": 892641
        },
        {
          "key": "acdc-admin-api",
          "doc_count": 762995
        },
        {
          "key": "soprano-produit-api",
          "doc_count": 689184
        },
        {
          "key": "acdc-backend-datalab-api",
          "doc_count": 661622
        },
        {
          "key": "apidatahub-configuration-rd-api",
          "doc_count": 566083
        },
        {
          "key": "API_CALENDRIER",
          "doc_count": 531500
        },
        {
          "key": "hmdrive-consultation-api",
          "doc_count": 488761
        },
        {
          "key": "demande-service-api",
          "doc_count": 487091
        },
        {
          "key": "gps-api",
          "doc_count": 475392
        },
        {
          "key": "sae-interactions-batch",
          "doc_count": 311758
        },
        {
          "key": "addagio-api",
          "doc_count": 276777
        },
        {
          "key": "hapiour-mutcim-api",
          "doc_count": 232418
        },
        {
          "key": "edition-document-api",
          "doc_count": 217205
        },
        {
          "key": "irma-api",
          "doc_count": 201978
        },
        {
          "key": "datahub-np6-batch",
          "doc_count": 187814
        },
        {
          "key": "hmdrive-recherche-api",
          "doc_count": 184892
        },
        {
          "key": "symphonie-conseil-simtar-api",
          "doc_count": 178943
        },
        {
          "key": "apisante-api",
          "doc_count": 171196
        },
        {
          "key": "svi-intelligent-api",
          "doc_count": 165465
        },
        {
          "key": "tabgar-tabref-api",
          "doc_count": 149818
        },
        {
          "key": "contralto-coll-back-api",
          "doc_count": 146646
        },
        {
          "key": "hapiour-entreprise-api",
          "doc_count": 145272
        },
        {
          "key": "rondo-api",
          "doc_count": 134966
        },
        {
          "key": "apiclient-listevaleur-api",
          "doc_count": 121184
        },
        {
          "key": "HMDRIVE",
          "doc_count": 115356
        },
        {
          "key": "extranet-ps-api",
          "doc_count": 111964
        },
        {
          "key": "datahome-isengard-batch",
          "doc_count": 104827
        },
        {
          "key": "ccm-precom-batch",
          "doc_count": 95293
        },
        {
          "key": "acdc-affiliation-api",
          "doc_count": 84879
        },
        {
          "key": "hmdrive-explorer-api",
          "doc_count": 81560
        },
        {
          "key": "pay-paiement-api",
          "doc_count": 76586
        },
        {
          "key": "contacts-api",
          "doc_count": 68382
        },
        {
          "key": "hapiour-inscription-api",
          "doc_count": 68263
        },
        {
          "key": "infinite-ccm-poi-batch",
          "doc_count": 64690
        },
        {
          "key": "hmdrive-injection-api",
          "doc_count": 62596
        },
        {
          "key": "acdc-demat-batch",
          "doc_count": 60586
        },
        {
          "key": "acps-injection-batch",
          "doc_count": 60140
        },
        {
          "key": "flowsentry-batch",
          "doc_count": 54679
        },
        {
          "key": "coconut-api",
          "doc_count": 52448
        },
        {
          "key": "octopus-api",
          "doc_count": 47023
        },
        {
          "key": "pacifique-socle-batch",
          "doc_count": 46538
        },
        {
          "key": "presto-api",
          "doc_count": 42317
        },
        {
          "key": "datahub-sid-batch",
          "doc_count": 42032
        },
        {
          "key": "apiclient-marketing-api",
          "doc_count": 41083
        },
        {
          "key": "octopus-task-batch",
          "doc_count": 38658
        },
        {
          "key": "apigps-api",
          "doc_count": 36743
        },
        {
          "key": "parhelie-socle-batch",
          "doc_count": 35955
        },
        {
          "key": "apiclient-interaction-jms-api",
          "doc_count": 35396
        },
        {
          "key": "BENDER",
          "doc_count": 33541
        },
        {
          "key": "ccm-wellcom-api",
          "doc_count": 33231
        },
        {
          "key": "svi-intelligent-kie-server-api",
          "doc_count": 32588
        },
        {
          "key": "hapiend-luke-api",
          "doc_count": 29187
        },
        {
          "key": "apiclient-consentement-jms-api",
          "doc_count": 27163
        },
        {
          "key": "apidatahub-relation-partenaires-rd-api",
          "doc_count": 27083
        },
        {
          "key": "acdc-demande-ga-rp-api",
          "doc_count": 27045
        },
        {
          "key": "apidatahub-sante-rd-api",
          "doc_count": 26258
        },
        {
          "key": "apidatahub-frais-chargement-rd-api",
          "doc_count": 26110
        },
        {
          "key": "acdc-demande-rp-api",
          "doc_count": 25746
        },
        {
          "key": "hapiend-validation-iban-xp-api",
          "doc_count": 24915
        },
        {
          "key": "fcc-calcul-taux-rs-api",
          "doc_count": 24750
        },
        {
          "key": "ostinato-xp-api",
          "doc_count": 24548
        },
        {
          "key": "apidatahub-interaction-refps-rd-api",
          "doc_count": 24067
        },
        {
          "key": "acdc-demandes-bonita-proxy-rs-api",
          "doc_count": 23987
        },
        {
          "key": "datahub-interaction-delegataire-gestion-stream",
          "doc_count": 23852
        },
        {
          "key": "hapiour-consentement-std-api",
          "doc_count": 23747
        },
        {
          "key": "fcc-notification-stream",
          "doc_count": 23286
        },
        {
          "key": "soprano-tarifer-xp-api",
          "doc_count": 23183
        },
        {
          "key": "ostinato-rs-api",
          "doc_count": 22680
        },
        {
          "key": "avise-frais-chargement-xp-api",
          "doc_count": 22509
        },
        {
          "key": "dsn-portail-api",
          "doc_count": 22491
        },
        {
          "key": "apidatahub-donnees-ref-rd-api",
          "doc_count": 22049
        },
        {
          "key": "signature-api",
          "doc_count": 21459
        },
        {
          "key": "sae-demandes-indexation-api",
          "doc_count": 20954
        },
        {
          "key": "traceo-api",
          "doc_count": 19862
        },
        {
          "key": "hadel-traitement-flux-rp-api",
          "doc_count": 19811
        },
        {
          "key": "datahub-delegataire-gestion-stream",
          "doc_count": 18911
        },
        {
          "key": "refps-demande-rp-api",
          "doc_count": 17468
        },
        {
          "key": "pacifique-export-metaux-batch",
          "doc_count": 17434
        },
        {
          "key": "referentiel-relations-partenaires-xp-api",
          "doc_count": 17426
        },
        {
          "key": "hmdrive-admin-api",
          "doc_count": 16625
        },
        {
          "key": "boreal-api",
          "doc_count": 15518
        },
        {
          "key": "cameleon-flux-tarification-api",
          "doc_count": 15313
        },
        {
          "key": "datahub-ccm-batch",
          "doc_count": 15312
        },
        {
          "key": "apidatahub-eligibilite-rs-api",
          "doc_count": 15234
        },
        {
          "key": "apidatahub-lien-compte-utilisateur-rd-api",
          "doc_count": 15227
        },
        {
          "key": "hapiend-adhinfo-api",
          "doc_count": 15149
        },
        {
          "key": "avise-delegataire-gestion-xp-api",
          "doc_count": 15117
        },
        {
          "key": "datahub-fusion-pp-batch",
          "doc_count": 13934
        },
        {
          "key": "formalites-medicales-rs-api",
          "doc_count": 13922
        },
        {
          "key": "symphonie-rest-to-wsdl-api",
          "doc_count": 13896
        },
        {
          "key": "cameleon-flux-configuration-api",
          "doc_count": 13812
        },
        {
          "key": "datahub-inpi-batch",
          "doc_count": 13749
        },
        {
          "key": "acdc-demande-delegataire-gestion-rp-api",
          "doc_count": 13617
        },
        {
          "key": "ccm-preference-demat-api",
          "doc_count": 13605
        },
        {
          "key": "hapiour-due-api",
          "doc_count": 13291
        },
        {
          "key": "datahub-sirene-batch",
          "doc_count": 13148
        },
        {
          "key": "sae-demandes-demat-batch",
          "doc_count": 13020
        },
        {
          "key": "apidatahub-interaction-delegataire-gestion-rd-api",
          "doc_count": 13016
        },
        {
          "key": "datahub-consentement-batch",
          "doc_count": 12776
        },
        {
          "key": "datahub-admin-api",
          "doc_count": 12481
        },
        {
          "key": "cameleon-flux-edition-api",
          "doc_count": 12435
        },
        {
          "key": "apidatahub-delegataire-gestion-rd-api",
          "doc_count": 12421
        },
        {
          "key": "robot-api",
          "doc_count": 12353
        },
        {
          "key": "avise-support-xp-api",
          "doc_count": 11904
        },
        {
          "key": "hapiour-consentement-std-batch",
          "doc_count": 11829
        },
        {
          "key": "hadel-integration-flux-batch",
          "doc_count": 11642
        },
        {
          "key": "ccm-compo-api",
          "doc_count": 11396
        },
        {
          "key": "JARVIS",
          "doc_count": 11231
        },
        {
          "key": "datahub-kafka-sid-batch",
          "doc_count": 10809
        },
        {
          "key": "relations-partenaires-mise-en-gestion-batch",
          "doc_count": 10755
        },
        {
          "key": "maestro-np6-batch",
          "doc_count": 10663
        },
        {
          "key": "soprano-renouvellement-tarification-indiv-batch",
          "doc_count": 10644
        },
        {
          "key": "hapiend-apicontact-xp-api",
          "doc_count": 10481
        },
        {
          "key": "ccm-configuration-api",
          "doc_count": 9917
        },
        {
          "key": "hapiend-eligibilite-xp-api",
          "doc_count": 9726
        },
        {
          "key": "ccm-transco-sefas-batch",
          "doc_count": 9528
        },
        {
          "key": "datahub-datalab-batch",
          "doc_count": 9510
        },
        {
          "key": "datahub-screening-batch",
          "doc_count": 9321
        },
        {
          "key": "datahub-interaction-batch",
          "doc_count": 9153
        },
        {
          "key": "hapiend-vivoptim-xp-api",
          "doc_count": 8214
        },
        {
          "key": "datahub-orgacollab-batch",
          "doc_count": 8137
        },
        {
          "key": "hapiend-simtar-xp-api",
          "doc_count": 7362
        },
        {
          "key": "infinite-ccm-poi-pecdevi-batch",
          "doc_count": 7309
        },
        {
          "key": "octopus-supervision-rs-api",
          "doc_count": 6973
        },
        {
          "key": "meridional-xp-api",
          "doc_count": 6669
        },
        {
          "key": "ermes-api",
          "doc_count": 6609
        },
        {
          "key": "octopus-automatisation-xp-api",
          "doc_count": 6423
        },
        {
          "key": "austral-api",
          "doc_count": 6190
        },
        {
          "key": "octopus-kafka-rs-api",
          "doc_count": 6093
        },
        {
          "key": "sae-webarchive-api",
          "doc_count": 6017
        },
        {
          "key": "pacifique-socle-dno-batch",
          "doc_count": 5795
        },
        {
          "key": "hapiend-formalites-medicales-xp-api",
          "doc_count": 5756
        },
        {
          "key": "beryl-batch",
          "doc_count": 5707
        },
        {
          "key": "soprano-integration-fichiers-batch",
          "doc_count": 5366
        },
        {
          "key": "ccm-publipostage-api",
          "doc_count": 5165
        },
        {
          "key": "metaux-interface-comptable-batch",
          "doc_count": 4871
        },
        {
          "key": "soprano-calcul-tarification-offre-batch",
          "doc_count": 4198
        },
        {
          "key": "HEXAGONE",
          "doc_count": 3877
        },
        {
          "key": "BERYL",
          "doc_count": 3791
        },
        {
          "key": "hapiour-exapi-api",
          "doc_count": 3789
        },
        {
          "key": "acdc-demandes-stream",
          "doc_count": 3757
        },
        {
          "key": "ccm-preference-demat-batch",
          "doc_count": 3492
        },
        {
          "key": "decibel-cr-corrige-api",
          "doc_count": 3395
        },
        {
          "key": "infinite-ccm-poi-ca-batch",
          "doc_count": 3020
        },
        {
          "key": "hapiend-incoming-gateway-api",
          "doc_count": 3008
        },
        {
          "key": "metaux-exportdata-batch",
          "doc_count": 2968
        },
        {
          "key": "octopus-kafka-batch",
          "doc_count": 2730
        },
        {
          "key": "seed-springboot-back",
          "doc_count": 2448
        },
        {
          "key": "external-entreprise-api",
          "doc_count": 2285
        },
        {
          "key": "beryl-api",
          "doc_count": 2268
        },
        {
          "key": "ccm-publipostage-batch",
          "doc_count": 2212
        },
        {
          "key": "pacifique-import-mind-batch",
          "doc_count": 2134
        },
        {
          "key": "pacifique-export-vega-batch",
          "doc_count": 2125
        },
        {
          "key": "FLOWSENTRY",
          "doc_count": 2091
        },
        {
          "key": "paraselene-socle-batch",
          "doc_count": 2055
        },
        {
          "key": "pacifique-export-sapfc-batch",
          "doc_count": 2052
        },
        {
          "key": "pacifique-export-mind-batch",
          "doc_count": 1992
        },
        {
          "key": "pacifique-import-vega-batch",
          "doc_count": 1967
        },
        {
          "key": "pacifique-import-jump-batch",
          "doc_count": 1862
        },
        {
          "key": "pacifique-import-sapfc-batch",
          "doc_count": 1774
        },
        {
          "key": "metaux-securisation-treso-batch",
          "doc_count": 1720
        },
        {
          "key": "pacifique-export-jump-batch",
          "doc_count": 1695
        },
        {
          "key": "pacifique-export-coda-batch",
          "doc_count": 1440
        },
        {
          "key": "cameleon-cart-lines-purge-batch",
          "doc_count": 1318
        },
        {
          "key": "shift-viamedis-api",
          "doc_count": 1121
        },
        {
          "key": "datahome-hercules-conversion-batch",
          "doc_count": 1110
        },
        {
          "key": "outgoing-gateway-api",
          "doc_count": 1074
        },
        {
          "key": "sae-alim-inter-batch",
          "doc_count": 675
        },
        {
          "key": "edition-aiguillage-api",
          "doc_count": 326
        },
        {
          "key": "cameleon-tarif-batch",
          "doc_count": 312
        },
        {
          "key": "oval-api",
          "doc_count": 226
        },
        {
          "key": "simtar-api",
          "doc_count": 106
        },
        {
          "key": "pacifique-export-density-batch",
          "doc_count": 2
        }
      ]
    }
  }
}

@maaaax
Copy link

maaaax commented Jun 11, 2024

I looked into inputControlVis.plugin.js and found terminate_after:Number(settings.autocompleteTerminateAfter)
So I changed my settings from
opensearchDashboards.autocompleteTimeout: 1000000
opensearchDashboards.autocompleteTerminateAfter: 1000000
both to 9000000 and restarted dashboards.

Additionally I cleared the cached js files in the browser.

For me it works now!
But it also works when I switch back to 1000000.

=> maybe just clearing the browser cache helps

@AMoo-Miki
Copy link

AMoo-Miki commented Jun 11, 2024

Spoke to @peternied about this.

A short version of the problem is that _search calls to OpenSearch containing terminate_after have started failing since 2.14.0 as they didn't in earlier versions. Coincidentally, this causes some failure in OSD but the root cause is the failure returned by OS.

We have at least 4 users of 2.14 reporting the same issue.

@franfreire, @mjakob-gh, @disaster37, and @maaaax: thank you all for all of the analysis and details you have provided. This information will be of substantial help to the team.

@AMoo-Miki AMoo-Miki changed the title same visualization works in opensearch 2.13, but fails in 2.14 _search calls to OpenSearch with terminate_after throw null_pointer_exception. Among others, this makes same visualizations that worked on OpenSearch 2.13 to fail on 2.14 Jun 11, 2024
@gaiksaya gaiksaya transferred this issue from opensearch-project/OpenSearch-Dashboards Jun 11, 2024
@andrross andrross added the Search Search query, autocomplete ...etc label Jun 11, 2024
@andrross
Copy link
Member

Added the search label to make sure it gets looked at by the right component team.

Also, I noticed CachedQueryResult.writeToNoId(CachedQueryResult.java:60) in the NPE stack trace in the issue description. This class was just introduced in #12542 with the tiered caching work. Tagging some folks who worked on that effort. @peteralfonsi @sohami @sgup432

@peteralfonsi
Copy link
Contributor

@andrross I think this is probably unrelated to CachedQueryResult, since that class was already present in 2.13 and hasn't been changed since then (besides a PR marking its inner class PolicyValues as ExperimentalAPI).

From the stacktrace and looking at the code, it seems like InternalAggregations.getInternalAggregations() is returning a list that incorrectly contains some null values, which must not have been happening in 2.13. @disaster37 , would you be able to share data we can use with your query to repro this?

@sohami
Copy link
Collaborator

sohami commented Jun 12, 2024

Looked into this with @jed326 and it is related to #12697 . He is creating a PR to fix it. The issue happens with combination of terminate_after and aggregation. So a workaround is to not have terminate_after in your request or have a higher value such that query is not actually force terminated early.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Search:Aggregations Search Search query, autocomplete ...etc v2.15.0 Issues and PRs related to version 2.15.0
Projects
Status: Done
Development

Successfully merging a pull request may close this issue.