Symptoms

UI graphs will display an error similar to: QUERY_NOT_SUPPORTED: Something is wrong around $.template.queries[0]: Elasticsearch exception [type=named_object_not_found_exception, reason=[1:678] unable to parse BaseAggregationBuilder with name [multiple-aggregation]: parser not found] DCDs report Statistics Overflow Protection, and the following error appears in /var/log/restjavad.log:"

Impact

Statistics are no longer visible for all BIG-IP systems, and some graphs fail to display current or historical data.

Conditions

In a BIG-IQ environment connected to BIG-IP systems that send statistics to one or more DCDs, the following errors appear: The following errors appear on the CM in /var/log/appiq/postaggregator.log: 2026-08-26 00:10:00,061 WARN c.f.a.c.a.AuthenticationTokenRestClient [scheduling-1] Failed to send POST request with <{}> to https://10.1.34.23:443/mgmt/ap/post/elasticsearch/index_aggregator/update?updateType=FULL_STARTED org.springframework.web.client.HttpServerErrorException$InternalServerError: 500 Server Error The DCD will have the following error in /var/log/elasticsearch/eslognode.log: [WARN][26 Aug 2026 00:10:00 CDT][ElasticSearchClient] POST request to http://localhost:9200/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED from 10.1.34.22 with body null failed with exception: method [POST], host [https://127.0.0.1:9200], URI [/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED], status line [HTTP/1.1 400 Bad Request] {"error":"no handler found for uri [/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED] and method [POST]"}

Workaround

# Copy validated and updated plugin ZIP files bypassing the cp alias \cp /shared/tmp/analytics-f5-aggregation-manager-es-plugin.zip /var/config/appiq/es_plugins/analytics-f5-aggregation-manager-es-plugin.zip \cp /shared/tmp/analytics-custom-aggregation-search-es-plugin.zip /var/config/appiq/es_plugins/analytics-custom-aggregation-search-es-plugin.zip # Verify files are now real ZIPs ls -lh /var/config/appiq/es_plugins/ # Set required environment variables export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk.x86_64 export ES_PATH_CONF=/var/config/rest/elasticsearch/config # Remount /usr as writable mount -o remount,rw /usr # Remove only if installed INSTALLED=$(/usr/share/elasticsearch/bin/elasticsearch-plugin list) echo "$INSTALLED" | grep -q "f5_aggregation_manager_es_plugin" && /usr/share/elasticsearch/bin/elasticsearch-plugin remove f5_aggregation_manager_es_plugin echo "$INSTALLED" | grep -q "custom_aggregation_search_plugin" && /usr/share/elasticsearch/bin/elasticsearch-plugin remove custom_aggregation_search_plugin # Install downloaded plugins /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///var/config/appiq/es_plugins/analytics-f5-aggregation-manager-es-plugin.zip /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch file:///var/config/appiq/es_plugins/analytics-custom-aggregation-search-es-plugin.zip # Verify both plugins are now present /usr/share/elasticsearch/bin/elasticsearch-plugin list # Restart ES to load the plugins bigstart restart elasticsearch # Remount /usr as read-only mount -o remount,ro /usr # Confirm handler registered (~30s after restart) grep "Registered node updates handler" /var/log/elasticsearch/eslognode.log # Test that the endpoint does not produce a 400 error curl -sk -u admin:admin -X POST "https://localhost:9200/mgmt/ap/elasticsearch/index_aggregator/update?updateType=FULL_STARTED"

Fix Information

None

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips