[BUG] array_index_out_of_bounds_exception on aggregations with unsigned_long

[psaiz]

Describe the bug

I have an index with a single document. The document is pretty simple, with two fields (a date and a number).
If I do an aggregation search on one of the fields, it works nicely. If I do the aggregation on both fields, it gives an error

Related component

Search:Aggregations

To Reproduce

1. Go to the console, and create the index:

PUT /my_test/
{"mappings":{
   "properties": {"date_created": {"type":"date"}, 
                  "distribution":{"properties": {"number_events":{"type":"unsigned_long"}}}
}
}
}

2. Create a document

PUT /my_test/_doc/1
{"date_created":"2024",
"distribution":{"number_events":1000000}
}

3. Do the query:

GET /my_test/_search
{
  "size":0,
  "aggs": {
     "year": {"date_histogram": {"field": "date_created",
         "interval": "year",    "format": "yyyy"}},
    "number_events": {"range": {
          "field": "distribution.number_events",
          "ranges": [{"key": "0--999", "from": 0, "to": 1000},
          {"key": "999--", "from": 1000, "to": 10000000000000}
          ]}}
}
}

The query returns a 500:

{
  "error": {
    "root_cause": [
      {
        "type": "array_index_out_of_bounds_exception",
        "reason": "Array index out of range: 16"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "my_test",
        "node": "Wy_wWhnNSlC1DsV6R-sBtw",
        "reason": {
          "type": "array_index_out_of_bounds_exception",
          "reason": "Array index out of range: 16"
        }
      }
    ],
    "caused_by": {
      "type": "array_index_out_of_bounds_exception",
      "reason": "Array index out of range: 16",
      "caused_by": {
        "type": "array_index_out_of_bounds_exception",
        "reason": "Array index out of range: 16"
      }
    }
  },
  "status": 500
}

Expected behavior

The query should not return a 500. It should return the proper value

Additional Details

It is probably related with the unsigned_long type. If, instead of unsigned_long, I use long, the query works properly

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 1,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "year": {
      "buckets": [
        {
          "key_as_string": "2024",
          "key": 1704067200000,
          "doc_count": 1
        }
      ]
    },
    "number_events": {
      "buckets": [
        {
          "key": "0--999",
          "from": 0,
          "to": 1000,
          "doc_count": 0
        },
        {
          "key": "999--",
          "from": 1000,
          "to": 10000000000000,
          "doc_count": 1
        }
      ]
    }
  }
}

[ajleong623]

I can look into this issue.

[sandeshkr419]

[Search Triage] thanks @psaiz for reporting this. @ajleong623 Do you want to take initial look - I can help further as well.

[ajleong623]

@psaiz @sandeshkr419 I tried to reproduce this error but received

    "error": {
        "root_cause": [
            {
                "type": "illegal_argument_exception",
                "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [date_created] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
            }
        ],
        "type": "search_phase_execution_exception",
        "reason": "all shards failed",
        "phase": "query",
        "grouped": true,
        "failed_shards": [
            {
                "shard": 0,
                "index": "my_test",
                "node": "rVPiRgiaTLqOGBu6tui4Qg",
                "reason": {
                    "type": "illegal_argument_exception",
                    "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [date_created] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
                }
            }
        ],
        "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [date_created] in order to load field data by uninverting the inverted index. Note that this can use significant memory.",
            "caused_by": {
                "type": "illegal_argument_exception",
                "reason": "Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [date_created] in order to load field data by uninverting the inverted index. Note that this can use significant memory."
            }
        }
    },
    "status": 400
}

@psaiz were there any additional plugins you used or was security configured?

[psaiz]

@ajleong623 , thanks for looking into this. In case it helps, I'm using version 2.18.0. We do have the security configured.

I'm surprised to see the message, since in the example I'm not using any text fields. One of them is a date, the other a number. Could it be that the mappings for the index were not created?

[ajleong623]

@psaiz The version I am using is 3.3.0-SNAPSHOT. I do not understand why the mappings parsed the date fields as text.

Output of http://localhost:9200/my-test/_mapping:

{
    "my-test": {
        "mappings": {
            "properties": {
                "date_created": {
                    "type": "date"
                },
                "distribution": {
                    "properties": {
                        "number_events": {
                            "type": "unsigned_long"
                        }
                    }
                }
            }
        }
    }
}

I will eventually have to look inside the internals of the parsing of the document and why it became parsed as a text field.

[ajleong623]

@psaiz I know this was a while ago, but I ran it again on the most recent OpenSearch, and it was fine. How is the issue currently?

[ajleong623]

Actually, I think I found a fix to this issue. It was not actually resolved.