OpenSearch Returns 200 OK Even When Aggregations Silently Fail or Mislead

OpenSearch aggregations can return empty or misleading results with a 200 OK status, offering no error or alert to indicate something went wrong. This happens because the aggregation engine counts values rather than validating field names against the index mapping, meaning a non-existent field and a field with no data are treated identically. A renamed field, a typo, or querying a text field instead of its keyword sub-field can all silently produce blank or incomplete dashboard panels. A particularly subtle case involves the default ignore_above: 256 limit on keyword sub-fields, which causes values longer than 256 characters to be dropped without any warning. Developers may only discover these silent failures when a human notices a blank or suspicious chart, potentially days or weeks after the issue began.