Skip to content

Fix metrics queries using .keyword on keyword-mapped fields - #613

Open
manuranga wants to merge 2 commits into
wso2:mainfrom
manuranga:fix/opensearch-keyword-suffix-in-metrics-queries
Open

Fix metrics queries using .keyword on keyword-mapped fields#613
manuranga wants to merge 2 commits into
wso2:mainfrom
manuranga:fix/opensearch-keyword-suffix-in-metrics-queries

Conversation

@manuranga

Copy link
Copy Markdown
Contributor

Problem

The OpenSearch adapter's BI and MI metrics queries appended .keyword to field names (icp_runtimeId.keyword, tagKey + ".keyword") in terms filters and composite aggregation sources. This works only when fields are auto-mapped by OpenSearch as text (which creates a .keyword sub-field), but fails silently when the index template maps those fields directly as keyword — returning zero results because the .keyword sub-field doesn't exist.

Root cause

The index template defines fields like icp_runtimeId, status, integration, etc. as bare keyword type. A keyword field has no .keyword sub-field — that pattern only exists on auto-mapped text fields. The metrics queries blindly appended .keyword to all tag fields, causing aggregation and filter clauses to match nothing.

Fix

Remove the .keyword suffix from:

  • icp_runtimeId in getBIMetricQuery and getMIMetricQuery terms filters
  • All METRICS_TAG_FIELDS in the BI composite aggregation sources
  • icp_runtimeId in the MI composite aggregation sources

Retain .keyword on MI payload.apiDetails.* fields — these are nested/auto-mapped (not in the index template) and correctly have .keyword sub-fields.

Affected queries

Location Field Before After
getBIMetricQuery L875 icp_runtimeId icp_runtimeId.keyword icp_runtimeId
getBIMetricQuery L887 all METRICS_TAG_FIELDS tagKey + ".keyword" tagKey
getMIMetricQuery L987 icp_runtimeId icp_runtimeId.keyword icp_runtimeId
getMIMetricQuery L998 icp_runtimeId (composite) icp_runtimeId.keyword icp_runtimeId

Testing

Verified on bare lab with BI runtime:

  • Metrics API returns inbound + outbound metrics correctly
  • Metrics UI renders charts, stat cards, and API table
  • Logs page continues to work (uses bare field names already)

The OpenSearch adapter appended '.keyword' to field names in BI and MI
metrics queries (terms filters and composite aggregation sources). This
fails when the index template maps those fields as 'keyword' directly,
since bare keyword fields have no '.keyword' sub-field — that sub-field
only exists on auto-mapped text fields.

Remove '.keyword' suffix from icp_runtimeId and all METRICS_TAG_FIELDS
references in getBIMetricQuery and getMIMetricQuery. Retain '.keyword'
on MI payload.* fields which are auto-mapped (not in the template).
@@ -872,19 +872,19 @@ isolated function getBIMetricQuery(types:MetricEntryRequest metricRequest) retur
if (runtimeIds.length() > 0) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 1

Suggested change
if (runtimeIds.length() > 0) {
isolated function getBIMetricQuery(types:MetricEntryRequest metricRequest) returns json|error {
log:printInfo("Building BI metric query for metric type: " + metricRequest.metricType);
// Extract request parameters

@@ -984,18 +984,19 @@ isolated function getMIMetricQuery(types:MetricEntryRequest metricRequest) retur
if (runtimeIds.length() > 0) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 2

Suggested change
if (runtimeIds.length() > 0) {
isolated function getMIMetricQuery(types:MetricEntryRequest metricRequest) returns json|error {
log:printInfo("Building MI metric query for metric type: " + metricRequest.metricType);
// Extract request parameters

@wso2-engineering wso2-engineering Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Agent Log Improvement Checklist

⚠️ Warning: AI-Generated Review Comments

  • The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
  • Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.

✅ Before merging this pull request:

  • Review all AI-generated comments for accuracy and relevance.
  • Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.
Comment Accepted (Y/N) Reason
#### Log Improvement Suggestion No: 1
#### Log Improvement Suggestion No: 2

@coderabbitai

coderabbitai Bot commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Warning

Rate limit exceeded

@manuranga has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 55 minutes and 29 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ac1448bc-a68b-4fea-8c48-9790294b7ea9

📥 Commits

Reviewing files that changed from the base of the PR and between 9685514 and 7af5098.

📒 Files selected for processing (2)
  • icp_server/resources/observability/opensearch-observability-dashboard/setup/index-template-request.json
  • icp_server/resources/observability/opensearch-observability-dashboard/setup/opensearch-dashboards-template.ndjson
📝 Walkthrough

Walkthrough

The changes update OpenSearch aggregation queries in the opensearch adapter service. The BI metric query (getBIMetricQuery) and MI metric query (getMIMetricQuery) are modified to reference icp_runtimeId directly instead of icp_runtimeId.keyword in their respective runtime-id terms filters and composite sources. For BI composite grouping, tag composite sources are similarly updated to use tag field names directly without the .keyword suffix. These changes align the query field references with the actual keyword mapping configuration in the OpenSearch index template. Related inline comments are updated accordingly.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the primary change: fixing metrics queries that incorrectly use .keyword suffix on keyword-mapped fields in the OpenSearch adapter.
Description check ✅ Passed The description provides detailed problem statement, root cause analysis, specific fixes with affected locations, and testing verification, but omits most template sections including Purpose/Goals/Approach structure and release/documentation/training sections.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

- Add metrics-logs and MI index patterns to the index template
- Add all METRICS_TAG_FIELDS as keyword mappings so queries can
  reference them directly (without .keyword suffix)
- Add response_time_seconds (float) and response_time (long) for
  proper numeric typing
- Update dashboard index-pattern field definitions: change fields
  from text to keyword, remove stale .keyword sub-field entries
- Update dashboard visualization configs: replace field.keyword
  references with bare field names for template-defined fields
- Retain .keyword for auto-mapped fields (host, log, message)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant