OpenSearch-Dashboards icon indicating copy to clipboard operation
OpenSearch-Dashboards copied to clipboard

[BUG] PPL does not work on alias fields, OSD does not report a useful error

Open Jon-AtAWS opened this issue 5 months ago • 1 comments
trafficstars

Describe the bug

I loaded the sample log data and created an index pattern. The sample data includes @timestamp as an alias field. I tried to use the discover panel, but PPL did not work for the index pattern at all. The only indication was a small triangle with an exclamation mark and the word "Error". The error message says "response is undefined"

Most people will start with @timestamp as their time field, so maybe we shouldn't show @timestamp (or any alias fields) in the time fields when I create the index pattern?

To Reproduce Steps to reproduce the behavior: See above. Load the sample log data. Create an index pattern. Use PPL.

Expected behavior

  1. PPL should work with alias fields
  2. The error message should clarify why the request failed

OpenSearch Version 2.19

Dashboards Version OSUI with an OpenSearch Service domain as a source

Plugins

N/A

Screenshots

Image Image

Host/Environment (please complete the following information):

  • OS: MacOS
  • Firefox

Jon-AtAWS avatar May 27 '25 23:05 Jon-AtAWS

To narrow down the scope, I ran the PPL query in the AOS 2.19 domain and didn’t encounter any issues. From what I can see, the query itself doesn’t involve any alias fields, so it might be helpful for the OSD developer to investigate further on the front-end side.

POST _plugins/_ppl
{
  "query": """
    source = opensearch_dashboards_sample_data_logs
    | where `response` = '200'
    | stats count() as count
  """
}

{
  "schema": [
    {
      "name": "count",
      "type": "integer"
    }
  ],
  "datarows": [
    [
      12832
    ]
  ],
  "total": 1,
  "size": 1
}

dai-chen avatar May 30 '25 17:05 dai-chen

Catch All Triage - 1 2

andrross avatar Jul 07 '25 16:07 andrross