Boolean indexing fails

[joshdevins]

I have a small generated dataset from bin/simulate in https://github.com/elastic/ml-search/tree/master/tools/universal/metrics. When I attempt to use a boolean filter on event.action, the query fails with a very long stack trace that I won't include but it ends with:

TypeError: int() argument must be a string, a bytes-like object or a number, not 'NoneType'

Checking info_es() also looked fine and this same filter works on other fields like event.category.

{'term': {'event.action': 'query'}}
index_pattern: ecs-test
Index:
 index_field: _id
 is_source_field: False
Mappings:
 capabilities:                           _source es_dtype        pd_dtype  searchable  \
@timestamp                   True     date  datetime64[ns]        True   
ecs.version                  True  keyword          object        True   
event.action                 True  keyword          object        True   
event.category               True  keyword          object        True   
event.created                True     date  datetime64[ns]        True   
event.id                     True  keyword          object        True   
labels.click.result.id       True     long           int64        True   
labels.click.result.rank     True     long           int64        True   
labels.query.id              True  keyword          object        True   
labels.query.value           True  keyword          object        True   
labels.results               True     long           int64        True   
source.user.id               True  keyword          object        True   

                          aggregatable  
@timestamp                        True  
ecs.version                       True  
event.action                      True  
event.category                    True  
event.created                     True  
event.id                          True  
labels.click.result.id            True  
labels.click.result.rank          True  
labels.query.id                   True  
labels.query.value                True  
labels.results                    True  
source.user.id                    True  
Operations:
 tasks: [('boolean_filter', {'term': {'event.action': 'query'}}), ('head', ('_doc', 5))]
 size: 5
 sort_params: _doc:asc
 columns: None
 post_processing: []

Relevant parts of the notebook looked something like:

import eland as ed
df = ed.read_es('http://elastic:changeme@localhost:9200/', 'ecs-test')

df[df['event.action'] == 'query']

Happy to help with getting the simulated date into an ES instance but it should be pretty straightforward. Just check the -h on the bin/simulate script.