Skip to content

[BUG] Calcite enabled patterns command aggregation mode on brain not returning all tokens #4363

@paulstn

Description

@paulstn

What is the bug?

When calcite engine is enabled, the patterns command does not return all the tokens.
For example, when running the query:

source = opensearch_dashboards_sample_data_logs | patterns `message` method=brain mode=aggregation

or the query

source = opensearch_dashboards_sample_data_logs | patterns `message` method=brain | stats count() by patterns_field

I get a result like this:

  "datarows": [
    [
      "<token1> - - [<token2>] \"GET <token3> HTTP/<token4><token5>\" 200 <token6> \"-\" \"Mozilla/<token7><token8> (<token9>; Linux <token10>_<token11>; rv:<token12><token13><token14>) Gecko/<token15> Firefox/<token16><token17><token18>\"",
      4935,
      {
        "<token1>": [
          "223.87.60.27",
          "130.246.123.197",
          "6.138.148.165",
          "218.148.135.12",
          "12.132.31.17",
          "129.138.185.193",
          "159.64.35.129",
          "78.142.163.191",
          "54.190.60.72",
          "221.0.214.157"
        ],
        "<token3>": [
          "/opensearch/opensearch-1.0.0.deb_1",
          "/beats/metricbeat_1",
          "/beats/metricbeat/metricbeat-6.3.2-amd64.deb_1",
          "/beats/filebeat/filebeat-6.3.2-linux-x86_64.tar.gz_1",
          "/opensearch/opensearch-1.0.0.tar.gz_1",
          "/beats_1",
          "/opensearch_dashboards/opensearch_dashboards-1.0.0-linux-x86_64.tar.gz_1",
          "/beats_1",
          "/beats/metricbeat/metricbeat-6.3.2-amd64.deb_1",
          "/opensearch_1"
        ],
        "<token2>": [
          "2018-07-22T00:39:02.912Z",
          "2018-07-22T03:26:21.326Z",
          "2018-07-22T03:57:39.612Z",
          "2018-07-22T04:18:12.345Z",
          "2018-07-22T05:36:25.812Z",
          "2018-07-22T05:39:39.668Z",
          "2018-07-22T06:06:42.742Z",
          "2018-07-22T06:10:08.359Z",
          "2018-07-22T06:15:34.660Z",
          "2018-07-22T06:21:08.365Z"
        ]
      }
    ]
  ],

Only values for the first three tokens are provided. This only seems to be an isue when method=brain, for simple patterns it gives all tokens.

How can one reproduce the bug?
Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

What is the expected behavior?
A clear and concise description of what you expected to happen.

What is your host/environment?

  • OS: [e.g. iOS]
  • Version [e.g. 22]
  • Plugins

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
Add any other context about the problem.

Metadata

Metadata

Assignees

Labels

PPLPiped processing languagebugSomething isn't working

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions