Symptoms

UI graphs will display an error similar to: QUERY_NOT_SUPPORTED: Something is wrong around $.template.queries[0]: Elasticsearch exception [type=named_object_not_found_exception, reason=[1:678] unable to parse BaseAggregationBuilder with name [multiple-aggregation]: parser not found] DCDs report Statistics Overflow Protection, and the following error appears in /var/log/restjavad.log:"

Impact

Statistics are no longer visible for all BIG-IP systems, and some graphs failed to display current or historical data.

Conditions

In a BIG-IQ environment connected to BIG-IP systems that send statistics to one or more DCDs, the following errors appear: The following errors appear on the CM in /var/log/appiq/postaggregator.log: 2026-08-26 00:10:00,061 WARN c.f.a.c.a.AuthenticationTokenRestClient [scheduling-1] Failed to send POST request with <{}> to https://10.1.34.23:443/mgmt/ap/post/elasticsearch/index_aggregator/update?updateType=FULL_STARTED org.springframework.web.client.HttpServerErrorException$InternalServerError: 500 Server Error The DCD will have the following error in /var/log/elasticsearch/eslognode.log: [WARN][26 Aug 2026 00:10:00 CDT][ElasticSearchClient] POST request to http://localhost:9200/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED from 10.1.34.22 with body null failed with exception: method [POST], host [https://127.0.0.1:9200], URI [/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED], status line [HTTP/1.1 400 Bad Request] {"error":"no handler found for uri [/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED] and method [POST]"}

Workaround

An EHF with this fix can be requested. However, the steps to mitigate ID 2313605 must be done as well in order to apply it. In larger environments that require a large outage window will be able to apply this fix in a shorter window with much less impact than installing an EHF. __ Manual workaround: # Copy validated and updated plugin ZIP files, bypassing the cp alias \cp /shared/tmp/analytics-f5-aggregation-manager-es-plugin.zip /var/config/appiq/es_plugins/analytics-f5-aggregation-manager-es-plugin.zip \cp /shared/tmp/analytics-custom-aggregation-search-es-plugin.zip /var/config/appiq/es_plugins/analytics-custom-aggregation-search-es-plugin.zip # Verify files are now real ZIPs ls -lh /var/config/appiq/es_plugins/ # Set required environment variables export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64 export ES_PATH_CONF=/var/config/rest/elasticsearch/config # Remount /usr as writable mount -o remount,rw /usr # Remove only if installed INSTALLED=$(/usr/share/elasticsearch/bin/elasticsearch-plugin list) echo "$INSTALLED" | grep -q "f5_aggregation_manager_es_plugin" && /usr/share/elasticsearch/bin/elasticsearch-plugin remove f5_aggregation_manager_es_plugin echo "$INSTALLED" | grep -q "custom_aggregation_search_plugin" && /usr/share/elasticsearch/bin/elasticsearch-plugin remove custom_aggregation_search_plugin # Install downloaded plugins /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///var/config/appiq/es_plugins/analytics-f5-aggregation-manager-es-plugin.zip /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///var/config/appiq/es_plugins/analytics-custom-aggregation-search-es-plugin.zip # Verify both plugins are now present /usr/share/elasticsearch/bin/elasticsearch-plugin list # Restart ES to load the plugins bigstart restart elasticsearch # Remount /usr as read-only mount -o remount,ro /usr # Confirm handler registered (~30s after restart) grep "Registered node updates handler" /var/log/elasticsearch/eslognode.log # Test that the endpoint does not produce a 400 error curl -sk -u admin:admin -X POST "https://localhost:9200/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED"

Fix Information

None

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips