NationalSecurityAgency/ghidra · error · ElasticException

{type} : {reason}

Error message

{type} : {reason}

What it means

Thrown by ElasticConnection.executeRawStatement when the HTTP request completed but Elasticsearch returned a non-success status (lastRequestSuccessful() is false). The error message is built by parseErrorJSON, which extracts 'type' and 'reason' from the ES error JSON document as '<type> : <reason>'. This is the primary Elasticsearch-side error surface for raw statements.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticConnection.java:201

	 * @return the response as parsed JsonObject
	 * @throws ElasticException for any problems with the connection
	 */
	public JsonObject executeRawStatement(String command, String path, String body)
			throws ElasticException {
		HttpURLConnection connection = null;
		try {
			URL httpURL = new URI(hostURL + path).toURL();
			connection = (HttpURLConnection) httpURL.openConnection();
			connection.setRequestMethod(command);
			connection.setRequestProperty("Content-Type", "application/json");
			connection.setDoOutput(true);
			try (Writer writer = new OutputStreamWriter(connection.getOutputStream())) {
				writer.write(body);
			}
			lastResponseCode = connection.getResponseCode();
			JsonObject resp = grabResponse(connection);
			if (!lastRequestSuccessful()) {
				throw new ElasticException(parseErrorJSON(resp));
			}
			return resp;
		}
		catch (URISyntaxException e) {
			throw new ElasticException("Error parsing URL: " + e.getMessage());
		}
		catch (IOException e) {
			throw new ElasticException("Error sending request: " + e.getMessage());
		}
		catch (JsonParseException e) {
			throw new ElasticException("Error parsing response: " + e.getMessage());
		}
		finally {
			if (connection != null) {
				connection.disconnect();
			}
		}

View on GitHub (pinned to d5f144c24d)

Solutions

1. Read the full 'type : reason' and any logged parseErrorCause detail to identify the ES error class.
2. Correct the request body/path/index per the ES error type (e.g. fix mapping, fix JSON syntax).
3. Check cluster health (_cluster/health) and resolve RED/yellow issues (shards, disk watermark).
4. Verify credentials/permissions if the error type indicates security/authorization.

try {
    return conn.executeRawStatement(command, path, body);
} catch (ElasticException e) {
    String m = e.getMessage();
    if (m.contains("mapper_parsing") || m.contains("illegal_argument")) {
        // fix body/path and retry
    } else throw e;
}

When it happens

Trigger: executeRawStatement(command, path, body) where the response code is an error (4xx/5xx) and ES returns an error JSON with type/reason fields. Examples: invalid index/mapping, malformed query body, version conflicts, mapper exceptions, script errors.

Common situations: Wrong index name or missing mapping; malformed JSON body; field type conflicts; cluster overloaded/RED status; insufficient disk/watermark; authentication/authorization failure surfacing as an ES error; versioning conflicts on concurrent writes.

Related errors

• connection.getResponseMessage()
• Error sending request: {message}
• Error parsing response: {message}
• Bad base64 encoding
• Error parsing URL: {message}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/5b0bdbdf9e479219. Report an issue: GitHub.