[BUG] ExpressionEvaluationException source = opensearch_dashboards_sample_data_logs #4324
Description
What is the bug?
"{\n \"error\": {\n \"reason\": \"Invalid Query\",\n \"details\": \"unsupported object class org.locationtech.jts.geom.Point\",\n \"type\": \"ExpressionEvaluationException\"\n },\n \"status\": 400\n}"
How can one reproduce the bug?
INgest the following data
opensearch_dashboards_sample_data_logs Mapping
{
"opensearch_dashboards_sample_data_logs": {
"mappings": {
"properties": {
"@timestamp": {
"type": "alias",
"path": "timestamp"
},
"agent": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"bytes": {
"type": "long"
},
"clientip": {
"type": "ip"
},
"event": {
"properties": {
"dataset": {
"type": "keyword"
}
}
},
"extension": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
},
"dest": {
"type": "keyword"
},
"src": {
"type": "keyword"
},
"srcdest": {
"type": "keyword"
}
}
},
"host": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"index": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ip": {
"type": "ip"
},
"machine": {
"properties": {
"os": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ram": {
"type": "long"
}
}
},
"memory": {
"type": "double"
},
"message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"phpmemory": {
"type": "long"
},
"referer": {
"type": "keyword"
},
"request": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"response": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tags": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"timestamp": {
"type": "date"
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"utc_time": {
"type": "date"
}
}
}
}
}
Data
{
"took": 2,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 10000,
"relation": "gte"
},
"max_score": 1,
"hits": [
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "7bKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1",
"bytes": 6219,
"clientip": "223.87.60.27",
"extension": "deb",
"geo": {
"srcdest": "IN:US",
"src": "IN",
"dest": "US",
"coordinates": {
"lat": 39.41042861,
"lon": -88.8454325
}
},
"host": "artifacts.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "223.87.60.27",
"machine": {
"ram": 8589934592,
"os": "win 8"
},
"memory": null,
"message": "223.87.60.27 - - [2018-07-22T00:39:02.912Z] \"GET /opensearch/opensearch-1.0.0.deb_1 HTTP/1.1\" 200 6219 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\"",
"phpmemory": null,
"referer": "http://twitter.com/success/wendy-lawrence",
"request": "/opensearch/opensearch-1.0.0.deb",
"response": 200,
"tags": [
"success",
"info"
],
"timestamp": "2025-09-07T00:39:02.912Z",
"url": "https://artifacts.opensearch.org/downloads/opensearch/opensearch-1.0.0.deb_1",
"utc_time": "2025-09-07T00:39:02.912Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "7rKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1",
"bytes": 6850,
"clientip": "130.246.123.197",
"extension": "",
"geo": {
"srcdest": "JP:IN",
"src": "JP",
"dest": "IN",
"coordinates": {
"lat": 38.58338806,
"lon": -86.46248778
}
},
"host": "www.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "130.246.123.197",
"machine": {
"ram": 3221225472,
"os": "win 8"
},
"memory": null,
"message": "130.246.123.197 - - [2018-07-22T03:26:21.326Z] \"GET /beats/metricbeat_1 HTTP/1.1\" 200 6850 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\"",
"phpmemory": null,
"referer": "http://www.opensearch-opensearch-opensearch.com/success/james-mcdivitt",
"request": "/beats/metricbeat",
"response": 200,
"tags": [
"success",
"info"
],
"timestamp": "2025-09-07T03:26:21.326Z",
"url": "https://www.opensearch.org/downloads/beats/metricbeat_1",
"utc_time": "2025-09-07T03:26:21.326Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "77KjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.50 Safari/534.24",
"bytes": 0,
"clientip": "120.49.143.213",
"extension": "css",
"geo": {
"srcdest": "CO:DE",
"src": "CO",
"dest": "DE",
"coordinates": {
"lat": 36.96015,
"lon": -78.18499861
}
},
"host": "cdn.opensearch-opensearch-opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "120.49.143.213",
"machine": {
"ram": 20401094656,
"os": "ios"
},
"memory": null,
"message": "120.49.143.213 - - [2018-07-22T03:30:25.131Z] \"GET /styles/main.css_1 HTTP/1.1\" 503 0 \"-\" \"Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.50 Safari/534.24\"",
"phpmemory": null,
"referer": "http://twitter.com/success/konstantin-feoktistov",
"request": "/styles/main.css",
"response": 503,
"tags": [
"success",
"login"
],
"timestamp": "2025-09-07T03:30:25.131Z",
"url": "https://cdn.opensearch-opensearch-opensearch.org/styles/main.css_1",
"utc_time": "2025-09-07T03:30:25.131Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "8LKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)",
"bytes": 14113,
"clientip": "99.74.118.237",
"extension": "deb",
"geo": {
"srcdest": "LK:IN",
"src": "LK",
"dest": "IN",
"coordinates": {
"lat": 48.31140472,
"lon": -114.2550694
}
},
"host": "artifacts.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "99.74.118.237",
"machine": {
"ram": 11811160064,
"os": "ios"
},
"memory": null,
"message": "99.74.118.237 - - [2018-07-22T03:34:43.399Z] \"GET /beats/metricbeat/metricbeat-6.3.2-amd64.deb_1 HTTP/1.1\" 200 14113 \"-\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)\"",
"phpmemory": null,
"referer": "http://www.opensearch-opensearch-opensearch.com/success/charles-camarda",
"request": "/beats/metricbeat/metricbeat-6.3.2-amd64.deb",
"response": 200,
"tags": [
"success",
"info"
],
"timestamp": "2025-09-07T03:34:43.399Z",
"url": "https://artifacts.opensearch.org/downloads/beats/metricbeat/metricbeat-6.3.2-amd64.deb_1",
"utc_time": "2025-09-07T03:34:43.399Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "8bKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)",
"bytes": 2492,
"clientip": "177.111.217.54",
"extension": "",
"geo": {
"srcdest": "MZ:US",
"src": "MZ",
"dest": "US",
"coordinates": {
"lat": 46.77917333,
"lon": -105.3047083
}
},
"host": "www.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "177.111.217.54",
"machine": {
"ram": 9663676416,
"os": "win 7"
},
"memory": null,
"message": "177.111.217.54 - - [2018-07-22T03:37:04.863Z] \"GET /enterprise_1 HTTP/1.1\" 200 2492 \"-\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)\"",
"phpmemory": null,
"referer": "http://twitter.com/success/gregory-harbaugh",
"request": "/enterprise",
"response": 200,
"tags": [
"success",
"info"
],
"timestamp": "2025-09-07T03:37:04.863Z",
"url": "https://www.opensearch.org/downloads/enterprise_1",
"utc_time": "2025-09-07T03:37:04.863Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "8rKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1",
"bytes": 0,
"clientip": "106.225.58.146",
"extension": "",
"geo": {
"srcdest": "EG:CN",
"src": "EG",
"dest": "CN",
"coordinates": {
"lat": 35.98531194,
"lon": -85.80931806
}
},
"host": "www.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "106.225.58.146",
"machine": {
"ram": 17179869184,
"os": "win 7"
},
"memory": null,
"message": "106.225.58.146 - - [2018-07-22T03:49:40.669Z] \"GET /apm_1 HTTP/1.1\" 503 0 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\"",
"phpmemory": null,
"referer": "http://www.opensearch-opensearch-opensearch.com/success/richard-o-covey",
"request": "/apm",
"response": 503,
"tags": [
"success",
"security"
],
"timestamp": "2025-09-07T03:49:40.669Z",
"url": "https://www.opensearch.org/downloads/apm_1",
"utc_time": "2025-09-07T03:49:40.669Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "87KjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1",
"bytes": 1872,
"clientip": "6.138.148.165",
"extension": "deb",
"geo": {
"srcdest": "IN:NG",
"src": "IN",
"dest": "NG",
"coordinates": {
"lat": 34.89107083,
"lon": -79.75905806
}
},
"host": "artifacts.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "6.138.148.165",
"machine": {
"ram": 9663676416,
"os": "win 8"
},
"memory": null,
"message": "6.138.148.165 - - [2018-07-22T03:57:39.612Z] \"GET /beats/metricbeat/metricbeat-6.3.2-amd64.deb_1 HTTP/1.1\" 200 1872 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\"",
"phpmemory": null,
"referer": "http://facebook.com/error/michael-p-anderson",
"request": "/beats/metricbeat/metricbeat-6.3.2-amd64.deb",
"response": 200,
"tags": [
"success",
"info"
],
"timestamp": "2025-09-07T03:57:39.612Z",
"url": "https://artifacts.opensearch.org/downloads/beats/metricbeat/metricbeat-6.3.2-amd64.deb_1",
"utc_time": "2025-09-07T03:57:39.612Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "9LKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1",
"bytes": 4531,
"clientip": "218.148.135.12",
"extension": "gz",
"geo": {
"srcdest": "BR:ES",
"src": "BR",
"dest": "ES",
"coordinates": {
"lat": 32.73355611,
"lon": -117.1896567
}
},
"host": "artifacts.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "218.148.135.12",
"machine": {
"ram": 11811160064,
"os": "win 8"
},
"memory": null,
"message": "218.148.135.12 - - [2018-07-22T04:18:12.345Z] \"GET /beats/filebeat/filebeat-6.3.2-linux-x86_64.tar.gz_1 HTTP/1.1\" 200 4531 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\"",
"phpmemory": null,
"referer": "http://www.opensearch-opensearch-opensearch.com/success/gemini-6a",
"request": "/beats/filebeat/filebeat-6.3.2-linux-x86_64.tar.gz",
"response": 200,
"tags": [
"warning",
"info"
],
"timestamp": "2025-09-07T04:18:12.345Z",
"url": "https://artifacts.opensearch.org/downloads/beats/filebeat/filebeat-6.3.2-linux-x86_64.tar.gz_1",
"utc_time": "2025-09-07T04:18:12.345Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "9bKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.50 Safari/534.24",
"bytes": 3629,
"clientip": "216.9.22.134",
"extension": "",
"geo": {
"srcdest": "CI:DZ",
"src": "CI",
"dest": "DZ",
"coordinates": {
"lat": 40.87480556,
"lon": -81.88825
}
},
"host": "www.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "216.9.22.134",
"machine": {
"ram": 3221225472,
"os": "win 8"
},
"memory": null,
"message": "216.9.22.134 - - [2018-07-22T05:27:11.939Z] \"GET /beats/metricbeat_1 HTTP/1.1\" 200 3629 \"-\" \"Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.50 Safari/534.24\"",
"phpmemory": null,
"referer": "http://facebook.com/success/tracy-caldwell-dyson",
"request": "/beats/metricbeat",
"response": 200,
"tags": [
"success",
"info"
],
"timestamp": "2025-09-07T05:27:11.939Z",
"url": "https://www.opensearch.org/downloads/beats/metricbeat_1",
"utc_time": "2025-09-07T05:27:11.939Z",
"event": {
"dataset": "sample_web_logs"
}
}
},
{
"_index": "opensearch_dashboards_sample_data_logs",
"_id": "9rKjWZkBAYF-6wILt4um",
"_score": 1,
"_source": {
"agent": "Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1",
"bytes": 9797,
"clientip": "12.132.31.17",
"extension": "gz",
"geo": {
"srcdest": "BD:EC",
"src": "BD",
"dest": "EC",
"coordinates": {
"lat": 32.14308333,
"lon": -111.1728611
}
},
"host": "artifacts.opensearch.org",
"index": "opensearch_dashboards_sample_data_logs",
"ip": "12.132.31.17",
"machine": {
"ram": 4294967296,
"os": "osx"
},
"memory": null,
"message": "12.132.31.17 - - [2018-07-22T05:36:25.812Z] \"GET /opensearch/opensearch-1.0.0.tar.gz_1 HTTP/1.1\" 200 9797 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\"",
"phpmemory": null,
"referer": "http://www.opensearch-opensearch-opensearch.com/success/musa-manarov",
"request": "/opensearch/opensearch-1.0.0.tar.gz",
"response": 200,
"tags": [
"success",
"security"
],
"timestamp": "2025-09-07T05:36:25.812Z",
"url": "https://artifacts.opensearch.org/downloads/opensearch/opensearch-1.0.0.tar.gz_1",
"utc_time": "2025-09-07T05:36:25.812Z",
"event": {
"dataset": "sample_web_logs"
}
}
}
]
}
}
What is the expected behavior?
It shouldn't throw exception
What is your host/environment?
- OS: Mac
- Version main latest
- Plugins
Do you have any screenshots?
If applicable, add screenshots to help explain your problem.
Do you have any additional context?
Add any other context about the problem.