Spike aggregation with percentile not working

[missaeldenadai]

Hi,

I'm trying to create an alert based on the spike of a percentile aggregation and I'm getting errors whether I set the field metric_agg_type with percentile or percentiles.
According to the docs, I should use percentiles. However, if I do so, I get a Python error saying Cannot unpack non-iterable NoneType object, because percentiles is not an expected value for spike_check_type and I think the reason is this line.
If, in the other hand, I use percentile, I get a schema validation error because I'm violating this rule of the schema.

Is this an issue? Is there a way to bypass this situation?

Below is my rule configuration.

  payment_send_spike_latency: |-
    ---
    name: some name
    type: spike_aggregation
    index: .ds-traces-apm-default*
    filter:
      - query:
          query_string:
            query: some_query
    timeframe:
      hours: 1
    metric_agg_key: transaction.duration.us
    metric_agg_type: percentile
    percentile_range: 95
    spike_type: "up"
    spike_height: 1.5
    min_doc_count: 10
    alert: slack
    <slack alert fields>

Thank you.

[jertel]

At first glance it looks like a bug. percentiles appears to be the correct value to use. Can you paste a stack trace of the error?

[missaeldenadai]

Stack trace of the error when using percentiles as metric_agg_type:

Index elastalert already exists. Skipping index creation.
ERROR:elastalert:Traceback (most recent call last):
  File "/usr/local/lib/python3.11/site-packages/elastalert/elastalert.py", line 1240, in handle_rule_execution
    num_matches = self.run_rule(rule, endtime, rule.get('initial_starttime'))
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/elastalert/elastalert.py", line 854, in run_rule
    if not self.run_query(rule, rule['starttime'], tmp_endtime):
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/elastalert/elastalert.py", line 617, in run_query
    rule_inst.add_aggregation_data(data)
  File "/usr/local/lib/python3.11/site-packages/elastalert/ruletypes.py", line 1198, in add_aggregation_data
    self.handle_event(event, agg_value, 'all')
  File "/usr/local/lib/python3.11/site-packages/elastalert/ruletypes.py", line 498, in handle_event
    ref, cur = self.get_spike_values(qk)
    ^^^^^^^^
TypeError: cannot unpack non-iterable NoneType object

ERROR:elastalert:Uncaught exception running rule payment send spike latency: cannot unpack non-iterable NoneType object

[jertel]

Thanks. I was able to reproduce it and have submitted a PR: #1323

[missaeldenadai]

That's great!

When will be available?

[jertel]

You can use the latest docker image now. The next official versioned release isn't yet defined.