# Grouping aggregated results with multi\_term leads to NullPointerException

**URL:** <https://forum.opensearch.org/t/grouping-aggregated-results-with-multi-term-leads-to-nullpointerexception/13795>\
**Category:** General Feedback\
**Tags:** troubleshoot\
**Created:** [April 5, 2023, 7:22am UTC](https://forum.opensearch.org/t/grouping-aggregated-results-with-multi-term-leads-to-nullpointerexception/13795 "2023-04-05T07:22:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![StefanHP8em](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@StefanHP8em](https://forum.opensearch.org/u/StefanHP8em)\
**Post date:** [April 5, 2023, 7:22am UTC](https://forum.opensearch.org/t/grouping-aggregated-results-with-multi-term-leads-to-nullpointerexception/13795/1 "2023-04-05T07:22:46Z")

</div>

Hi OpenSearch Community,

we want to use OpenSearch for querying our systems to get aggregated system information like CPU and RAM usage.  
Therefore we use date historgram aggregation. Since we want to have those measures for different hosts / containers / processes we need also a kind of grouping mechanism which we tried to realize with the multi\_terms feature.

Our initial query was looking like this:

```json
{
  "aggs": {
    "xLCAggPerTime": {
      "aggs": {
        "MyGroupingAggregate": {
          "aggs": {
            "CPU": {
              "avg": {
                "field": "system.cpu.total.norm.pct"
              }
            },
            "Memory": {
              "avg": {
                "field": "system.memory.actual.used.bytes"
              }
            }
          }, 
          "multi_terms": {
            "terms": [
                {"field": "host.name.keyword"},
                {"field": "agent.type.keyword"}
              ]
          }
        },
        "xLCAggBucketSort": {
          "bucket_sort": {
            "from": 0,
            "size": 1000
          }
        }
      },
      "date_histogram": {
        "field": "@timestamp",
        "fixed_interval": "1s"
      }
    }
  },
  "from": 0,
  "query": {
    "range": {
      "ObservedTimestamp": {
        "gte": "2023-02-09T12:15:47Z",
        "lt": "2023-02-09T12:16:47Z"
      }
    }
  },
  "size": 0,
  "sort": [
    {
      "ObservedTimestamp": {
        "unmapped_type": "date",
        "order": "asc"
      }
    }
  ]
}

```

However this query results in the following execption:

```auto
java.lang.NullPointerException: Cannot invoke \"org.opensearch.common.io.stream.NamedWriteable.getWriteableName()\" because \"namedWriteable\" is null

```

If needed I can also provide the full error response, but for me it seems not to contain much more meaningful information.

I also tried to minimize the query in order to isolate the issue and it came out that the following query will still produce the error:

```json
GET _search
{
  "aggs": {
    "xLCAggPerTime": {
      "aggs": {
        "MyGroupingAggregate": {
          "multi_terms": {
            "terms": [
                {"field": "host.name"},
                {"field": "agent.type"}
              ]
          }
        }
      },
      "date_histogram": {
        "field": "@timestamp",
        "fixed_interval": "60s"
      }
    }
  }
}

```

Can someone support here? Are we doing something wrong?  
What would be the best way to aggregate CPU measures and group it by different fields like hostname and process name?

> **IMPORTANT** : Both queries DO work and **provide the results perfectly** if I just use the terms block and **remove the surrounding multi\_terms**! However then I am restricted to one single field for grouping, which is not sufficient for my usecase.

Thank you already in advance for your help! 🙂

Additional information:  
OpenSearch Version used: 2.2.0 & 2.6.0  
MetricBeat: 2.7.12.1

---

<div class="post-metadata">

**Author:** ![svargasn](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@svargasn](https://forum.opensearch.org/u/svargasn)\
**Post date:** [August 4, 2023, 11:40pm UTC](https://forum.opensearch.org/t/grouping-aggregated-results-with-multi-term-leads-to-nullpointerexception/13795/2 "2023-08-04T23:40:41Z")

</div>

@StefanHP8em Were you able to solve the issue?

---

<div class="post-metadata">

**Author:** ![StefanHP8em](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@StefanHP8em](https://forum.opensearch.org/u/StefanHP8em)\
**Post date:** [August 29, 2023, 11:56am UTC](https://forum.opensearch.org/t/grouping-aggregated-results-with-multi-term-leads-to-nullpointerexception/13795/3 "2023-08-29T11:56:03Z")

</div>

The issue got fixed in 2.9.0

> <https://github.com/opensearch-project/OpenSearch/issues/7089>
>
> Hi all,
> we want to use OpenSearch for querying our systems to get aggregated sy…stem information like CPU and RAM usage.
> Therefore we use date historgram aggregation. Since we want to have those measures for different hosts / containers / processes we need also a kind of grouping mechanism which we tried to realize with the \`multi\_terms\` feature.
> 
> Our initial query was looking like this:
> 
> \`\`\`
> {
> "aggs": {
> "xLCAggPerTime": {
> "aggs": {
> "MyGroupingAggregate": {
> "aggs": {
> "CPU": {
> "avg": {
> "field": "system.cpu.total.norm.pct"
> }
> },
> "Memory": {
> "avg": {
> "field": "system.memory.actual.used.bytes"
> }
> }
> }, 
> "multi\_terms": {
> "terms": \[
> {"field": "host.name"},
> {"field": "agent.type"}
> \]
> }
> },
> "xLCAggBucketSort": {
> "bucket\_sort": {
> "from": 0,
> "size": 1000
> }
> }
> },
> "date\_histogram": {
> "field": "@timestamp",
> "fixed\_interval": "1s"
> }
> }
> },
> "from": 0,
> "query": {
> "range": {
> "@timestamp": {
> "gte": "2023-02-09T12:15:47Z",
> "lt": "2023-02-09T12:16:47Z"
> }
> }
> },
> "size": 0,
> "sort": \[
> {
> "@timestamp": {
> "unmapped\_type": "date",
> "order": "asc"
> }
> }
> \]
> }
> \`\`\`
> However this query results in the following execption:
> \`
> java.lang.NullPointerException: Cannot invoke \\"org.opensearch.common.io.stream.NamedWriteable.getWriteableName()\\" because \\"namedWriteable\\" is null
> \`
> 
> If needed I can also provide the full error response, but for me it seems not to contain much more meaningful information.
> 
> The query runs fine if the \`multi\_terms\` part is removed, leaving only 
> \`\`\` json
> "terms": 
> {"field": "agent.type.keyword"}
>               
> \`\`\`
> I also tried to minimize the query in order to isolate the issue and it came out that the following query will still produce the error:
> 
> \`\`\` json
> {
> "aggs": {
> "xLCAggPerTime": {
> "aggs": {
> "MyGroupingAggregate": {
> "multi\_terms": {
> "terms": \[
> {"field": "host.name"},
> {"field": "agent.type"}
> \]
> }
> }
> },
> "date\_histogram": {
> "field": "@timestamp",
> "fixed\_interval": "60s"
> }
> }
> }
> }
> \`\`\`
> 
> \*\*Important Note: The queries were tested with ElasticSearch 8.7.0 and they worked as expected. So the queries themsselves can be considered to be correct.\*\*
> 
> Thank you already in advance for your help! :slight\_smile:
> 
> \*\*To Reproduce\*\*
> Have an OpenSearch Instance with MetricBeat and run the above query.
> 
> \*\*Expected behavior\*\*
> The query runs and returns zero or more results, depending on the data in OpenSearch. However, there shall not be a Nullpointer Exception.
> 
> \*\*Plugins\*\*
> MetricBeat
> 
> \*\*Host/Environment (please complete the following information):\*\*
> OpenSearch Version used: 2.2.0 & 2.6.0
> MetricBeat: 2.7.12.1