NationalSecurityAgency/ghidra · error · ElasticException

Error parsing response:

Error message

Error parsing response: 

What it means

JsonParseException handler inside executeStatementExpectFailure. The method tolerates ES HTTP errors, so this fires only when the body that came back is not parseable JSON (HTML proxy page, captive portal, truncated response, or a non-ES endpoint).

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticConnection.java:338

			connection = (HttpURLConnection) httpURL.openConnection();
			connection.setRequestMethod(command);
			connection.setRequestProperty("Content-Type", "application/json");
			connection.setDoOutput(true);
			try (Writer writer = new OutputStreamWriter(connection.getOutputStream())) {
				writer.write(body);
			}
			lastResponseCode = connection.getResponseCode();
			JsonObject resp = grabResponse(connection);
			return resp;
		}
		catch (URISyntaxException e) {
			throw new ElasticException("Error parsing URL: " + e.getMessage());
		}
		catch (IOException e) {
			throw new ElasticException("Error sending request: " + e.getMessage());
		}
		catch (JsonParseException e) {
			throw new ElasticException("Error parsing response: " + e.getMessage());
		}
		finally {
			if (connection != null) {
				connection.disconnect();
			}
		}
	}

	/**
	 * Send a bulk request to the elasticsearch server.  This is a special format for combining multiple commands
	 * and is structured slightly differently from other commands.
	 * @param path is the specific URL path receiving the bulk command
	 * @param body is structured list of JSON commands and source
	 * @return the response as parsed JsonObject
	 * @throws ElasticException for any problems with the connection
	 */
	public JsonObject executeBulk(String path, String body) throws ElasticException {
		HttpURLConnection connection = null;

View on GitHub (pinned to d5f144c24d)

Solutions

1. Confirm the endpoint is ES: curl <url>/ returns JSON cluster info.
2. Raise or remove proxy response buffering/body-size limits for the ES route.
3. Fail fast before probing if a preflight root GET is not JSON.

Example fix

// before
JsonObject r = c.executeStatementExpectFailure(ElasticConnection.GET, idx, body);
// after
if (!isElastic(c)) throw new IllegalStateException("not an ES endpoint");
JsonObject r = c.executeStatementExpectFailure(ElasticConnection.GET, idx, body);

public static boolean returnsJson(String url) {
    try { Reader r = new InputStreamReader(URI.create(url).toURL().openStream());
          JsonParser.parseReader(r); return true; }
    catch (Exception e) { return false; }
}

try {
    return conn.executeStatementExpectFailure(cmd, path, body);
} catch (ElasticException e) {
    if (e.getMessage().startsWith("Error parsing response"))
        throw new IllegalStateException("Non-JSON response during probe; verify ES endpoint/proxy", e);
    throw e;
}

When it happens

Trigger: executeStatementExpectFailure receives HTML from a reverse proxy (502/503) or an intercepting portal instead of JSON; response truncated by a proxy body limit; base URL hits a non-ES service.

Common situations: ES behind a proxy that returns an HTML maintenance page under load; wrong base URL; misconfigured TLS terminating at a different service.

Related errors

• Error parsing response: {message}
• Couldn't open remote program: {} for {}.
• Could not start postgres server process
• Unable to connect to server
• {database.getLastError().message}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/454b5e16b28ff70d. Report an issue: GitHub.