Error message Opensearch reducePhase.aggregations is null

Graylog Central (peer support)
1

Hi hi, I am facing this error constantly. I changed from Elastic Search 7.10.2 to Open Search because of the same error! Can you help me?

1. Describe your incident:
This messages is appearing on my Graylog:

OpenSearch exception [type=null_pointer_exception, reason=Cannot invoke “org.opensearch.search.aggregations.InternalAggregations.getSerializedSize()” because “reducePhase.aggregations” is null

2. Describe your environment:

  • OS Information: Debian 11 x86_64

  • Package Version:
    Graylog 5.2.4
    Opensearch: 2.5.0
    MongoDB. 6.0.13

  • Service logs, configurations, and environment variables:
    ERROR [EventProcessorExecutionJob] Event processor <aggregation-v1/65d5f5c5ec9d485ded1caa03> failed to execute: OpenSearch exception [type=null_pointer_exception, reason=Cannot invoke “org.opensearch.search.aggregations.InternalAggregations.getSerializedSize()” because “reducePhase.aggregations” is null]. (retry in 5000 ms)
    org.graylog.events.processor.EventProcessorException: OpenSearch exception [type=null_pointer_exception, reason=Cannot invoke “org.opensearch.search.aggregations.InternalAggregations.getSerializedSize()” because “reducePhase.aggregations” is null].

Using curl -XGET http://localhost:9200/_cluster/allocation/explain?pretty I see this:

{
“error” : {
“root_cause” : [
{
“type” : “illegal_argument_exception”,
“reason” : “unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]”
}
],
“type” : “illegal_argument_exception”,
“reason” : “unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]”
},
“status” : 400
}

3. What steps have you already taken to try and solve the problem?
I tried to go from Elasticsearch to Opensearch, but didn’t work.
Everything seems to work correctly, except for this error…

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Hey @lcals

Error looks something like this post.

3

Thanks for answering!

So is this a code error?

Just to update, the Opensearch was updated from version 2.5 to 2.9 and the message is still there.

4

Hey,

This error maybe coming from a widget on dashboard or saved search.

5

That was true. Thx!!!

It seems that an alert that I created was somehow wrong. When I excluded it, the error disappeared.

1 Like
6

But I have one more question: why am I still seeing this if my cluster is green and there are no error messages in the web interface or the in logs anymore?

curl -XGET http://localhost:9200/_cluster/allocation/explain?pretty
{
“error” : {
“root_cause” : [
{
“type” : “illegal_argument_exception”,
“reason” : “unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]”
}
],
“type” : “illegal_argument_exception”,
“reason” : “unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]”
},
“status” : 400
}

7

Hey @lcals

Not sure, have you restarted your service or rotated you index?

8

Both.
Restarted and rotated.

After the update from Opensearch (OS) 2.5 to 2.9, the GL webpage wasn’t reachable.
I needed to restart all the processes (GL,OS and MongoDB) to make it work.
Then the status of the OS was yellow. I rotated the indices.
After this, I used the commands:

And everything was green again.
The only problem is still that error message

9

comm
comm3652×213 25.1 KB

10

By chance are you using JAVA 17? If not I would chack that.

Found here

11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.