NationalSecurityAgency/ghidra · error · ElasticException

Could not resolve filter specifying function: [

Error message

Could not resolve filter specifying function: [

What it means

Thrown in recoverExternalFunctionId when queryFuncNameMatch returns a result set whose size is not exactly 1. A size of 0 means no function with the given name exists in the executable; a size of 2 (the query max) means the function name is ambiguous — multiple functions in the same executable share that name.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java:2690

	 * These 3 Strings are designed to uniquely identify a library function.
	 * @param exeName is the name of the executable
	 * @param funcName is the name of the function
	 * @param arch is the executable architecture
	 * @return the document id of the matching function
	 * @throws ElasticException if the function (the executable) doesn't exist
	 */
	public String recoverExternalFunctionId(String exeName, String funcName, String arch)
			throws ElasticException {
		String md5 = ExecutableRecord.calcLibraryMd5Placeholder(exeName, arch);
		JsonObject row = queryMd5ExeMatch(md5);
		if (row == null) {
			throw new ElasticException(
				"Could not resolve filter specifying executable: " + exeName);
		}
		String exeId = row.get("_id").getAsString();
		JsonArray descres = queryFuncNameMatch(exeId, funcName, 2);
		if (1 != descres.size()) {
			throw new ElasticException(
				"Could not resolve filter specifying function: [" + exeName + "]" + funcName);
		}
		RowKeyElastic eKey = RowKeyElastic.parseExeIdString(exeId);
		StringBuilder buffer = new StringBuilder();
		eKey.generateLibraryFunctionId(buffer, funcName);
		return buffer.toString();
	}

	/**
	 * For every function currently in the manager, fill in its call-graph information.
	 * This involves querying the database for child information, adding the cross-link
	 * information (CallgraphEntry) between FunctionDescriptions, and possibly querying
	 * for new library executables and functions
	 * @param manager is the collection of functions to link
	 * @throws LSHException for problems updating the container
	 * @throws ElasticException for communication problems with the server
	 */
	private void queryCallgraph(DescriptionManager manager) throws LSHException, ElasticException {

View on GitHub (pinned to d5f144c24d)

Solutions

1. Verify the funcName is spelled correctly and exists in the specified library executable.
2. If duplicates exist (size > 1), disambiguate by using a function address or a more specific identifier instead of the name.
3. Re-ingest the library with unique function names if symbol collisions are the cause.
4. Query the executable index for name_func to list all function names in that executable and confirm uniqueness.

// Verify the function exists and is unique before calling recoverExternalFunctionId
String md5 = ExecutableRecord.calcLibraryMd5Placeholder(exeName, arch);
JsonObject exeRow = queryMd5ExeMatch(md5);
if (exeRow == null) return; // handled by 877
String exeId = exeRow.get("_id").getAsString();
JsonArray funcs = queryFuncNameMatch(exeId, funcName, 2);
if (funcs.size() == 0) {
    throw new IllegalArgumentException("Function '" + funcName + "' not found in " + exeName);
}
if (funcs.size() > 1) {
    throw new IllegalArgumentException("Function name '" + funcName + "' is ambiguous in " + exeName);
}

try {
    String funcId = database.recoverExternalFunctionId(exeName, funcName, arch);
} catch (ElasticException e) {
    if (e.getMessage().contains("Could not resolve filter specifying function")) {
        Msg.warn(this, "Function not found or ambiguous: [" + exeName + "]" + funcName);
        // Check spelling or disambiguate by address
    }
    throw e;
}

When it happens

Trigger: After the executable is found (exeId resolved), queryFuncNameMatch(exeId, funcName, 2) is issued. If the result array size is not 1 (either 0 or 2), the exception is thrown with the exeName and funcName in the message.

Common situations: Typo in the function name; function was renamed or does not exist in the library version that was ingested; duplicate function names within the same executable from symbol collisions, overloaded C++ functions, or weak symbols.

Related errors

• Could not resolve filter specifying executable:
• Could not resolve filter specifying executable:
• Could not resolve filter specifying function: [
• Could not (uniquely) match executable
• {getType()}scripts cannot be used for context [{context.name

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/cd2111decc2ac99c. Report an issue: GitHub.