NationalSecurityAgency/ghidra · error · ElasticException

Unknown error format

Error message

Unknown error format

What it means

Thrown by executeBulk when the bulk request returns a non-2xx status AND parseErrorJSON cannot recognize the error shape: resp.error is neither a String nor a JsonObject (it is missing, an array, a number, or a boolean). The literal returned string is 'Unknown error format'. The real cause is hidden because the ES error structure was unexpected.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticConnection.java:369

	 * @param body is structured list of JSON commands and source
	 * @return the response as parsed JsonObject
	 * @throws ElasticException for any problems with the connection
	 */
	public JsonObject executeBulk(String path, String body) throws ElasticException {
		HttpURLConnection connection = null;
		try {
			URL httpURL = new URI(hostURL + path).toURL();
			connection = (HttpURLConnection) httpURL.openConnection();
			connection.setRequestMethod(POST);
			connection.setRequestProperty("Content-Type", "application/x-ndjson");
			connection.setDoOutput(true);
			try (Writer writer = new OutputStreamWriter(connection.getOutputStream())) {
				writer.write(body);
			}
			lastResponseCode = connection.getResponseCode();
			JsonObject resp = grabResponse(connection);
			if (!lastRequestSuccessful()) {
				throw new ElasticException(parseErrorJSON(resp));
			}
			return resp;
		}
		catch (URISyntaxException e) {
			throw new ElasticException("Error parsing URL: " + e.getMessage());
		}
		catch (IOException e) {
			throw new ElasticException("Error sending request: " + e.getMessage());
		}
		catch (JsonParseException e) {
			throw new ElasticException("Error parsing response: " + e.getMessage());
		}
		finally {
			if (connection != null) {
				connection.disconnect();
			}
		}
	}

View on GitHub (pinned to d5f144c24d)

Solutions

1. Capture the raw response: temporarily log resp.toString() in a wrapper to see the actual error body, since 'Unknown error format' discards it.
2. Confirm you are hitting real ES (curl -XPOST <url>/_bulk with a tiny NDJSON) and note the cluster version.
3. If a proxy injects its own error JSON, route bulk traffic directly to ES or teach the proxy to pass ES errors through unchanged.

Example fix

// before: parseErrorJSON returns 'Unknown error format', cause lost
JsonObject r = c.executeBulk("_bulk", ndjson);
// after: wrap to preserve the raw body on failure for diagnosis
class BulkProbe { static JsonObject run(ElasticConnection c, String b) throws ElasticException { try { return c.executeBulk("_bulk", b); } catch (ElasticException e) { if (e.getMessage().equals("Unknown error format")) Msg.error(BulkProbe.class, "raw bulk error body unseen by lib"); throw e; } } }

// No pre-validation possible from outside; capture the raw body via a debug wrapper instead.
public static JsonObject bulkWithRawOnError(ElasticConnection c, String ndjson, java.util.function.Consumer<String> rawSink) throws ElasticException {
    try { return c.executeBulk("_bulk", ndjson); }
    catch (ElasticException e) {
        if (e.getMessage().equals("Unknown error format")) rawSink.accept("library discarded the raw bulk error body; curl the _bulk endpoint manually to inspect it");
        throw e;
    }
}

try {
    return conn.executeBulk(path, ndjson);
} catch (ElasticException e) {
    if (e.getMessage().equals("Unknown error format")) {
        // library hid the cause; reproduce with curl -XPOST <url>/_bulk to read the real error
        throw new IllegalStateException("Unrecognized bulk error envelope; inspect ES/proxy response manually", e);
    }
    throw e;
}

When it happens

Trigger: A bulk endpoint that is not standard ES (proxy/gateway returning an error envelope); an ES major-version change that reshaped the bulk error JSON; a partial bulk failure whose error field is an array; a 4xx from a misconfigured bulk path returning a non-ES error document.

Common situations: ES 7->8 upgrade changing error envelope shape; a reverse proxy's own JSON error body (e.g. {"message":...} with no 'error' key); hitting '_bulk' on a node where the bulk API is disabled.

Related errors

• Mismatch in decrementVectorCounters
• Error during vector deletion
• {getType()}scripts cannot be used for context [{context.name
• Unknown script name {scriptSource}
• Document is missing "features"

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/4b49fb3d54d44f85. Report an issue: GitHub.