percentile_range is ignored when metric_agg_script is used

[koooommmm]

Describe the bug

When using a metric_aggregation or spike_metric_aggregation rule with
metric_agg_type: percentiles, the percentile_range value is omitted from the generated Elasticsearch query if metric_agg_script is also defined.

As a workaround, the percentile value must be hardcoded directly inside the metric_agg_script, for example by adding percents: [95]:

metric_agg_script:
  script: doc['field1'].value
  percents: [95]

Cause

This behavior originates from the MetricAggregationRule.generate_aggregation_query method in
elastalert2/elastalert/ruletypes.py:

elastalert2/elastalert/ruletypes.py

Lines 1094 to 1100 in 417d5b4

	def generate_aggregation_query(self):
	if self.rules.get('metric_agg_script'):
	return {self.metric_key: {self.rules['metric_agg_type']: self.rules['metric_agg_script']}}
	query = {self.metric_key: {self.rules['metric_agg_type']: {'field': self.rules['metric_agg_key']}}}
	if self.rules['metric_agg_type'] in self.allowed_percent_aggregations:
	query[self.metric_key][self.rules['metric_agg_type']]['percents'] = [self.rules['percentile_range']]
	return query

If metric_agg_script exists, the method immediately returns the query part containing only the script, skipping the logic that adds the percentile_range as the percents key.

Question

Is this behavior intended?
If not, would it be possible to support using metric_agg_script together with dynamically configured percentile ranges (i.e., without requiring percents to be hardcoded inside the script)?

[jertel]

I suspect the author intended this to be an "either-or" usage. Either you are using the built-in aggregations, or you are fully handling the calculation via a script. As to whether you can combine them, I believe it's possible, and it seems you have already proven it. So if you want to put a PR to allow this behavior, that's fine with me. There is a CONTRIBUTING.md file that explains what is required.

[koooommmm]

Thanks for the explanation!

I understand the original intent of treating the script as a full override.
Since combining the script with percentiles also seems feasible, I’ll review the code and the CONTRIBUTING.md guide to see whether I can put together a PR.

Thanks again for the quick feedback!