{"record":{"id":"4b49fb3d54d44f85","repo":"NationalSecurityAgency/ghidra","slug":"unknown-error-format","errorCode":null,"errorMessage":"Unknown error format","messagePattern":"Unknown error format","errorType":"exception","errorClass":"ElasticException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticConnection.java","lineNumber":369,"sourceCode":"\t * @param body is structured list of JSON commands and source\n\t * @return the response as parsed JsonObject\n\t * @throws ElasticException for any problems with the connection\n\t */\n\tpublic JsonObject executeBulk(String path, String body) throws ElasticException {\n\t\tHttpURLConnection connection = null;\n\t\ttry {\n\t\t\tURL httpURL = new URI(hostURL + path).toURL();\n\t\t\tconnection = (HttpURLConnection) httpURL.openConnection();\n\t\t\tconnection.setRequestMethod(POST);\n\t\t\tconnection.setRequestProperty(\"Content-Type\", \"application/x-ndjson\");\n\t\t\tconnection.setDoOutput(true);\n\t\t\ttry (Writer writer = new OutputStreamWriter(connection.getOutputStream())) {\n\t\t\t\twriter.write(body);\n\t\t\t}\n\t\t\tlastResponseCode = connection.getResponseCode();\n\t\t\tJsonObject resp = grabResponse(connection);\n\t\t\tif (!lastRequestSuccessful()) {\n\t\t\t\tthrow new ElasticException(parseErrorJSON(resp));\n\t\t\t}\n\t\t\treturn resp;\n\t\t}\n\t\tcatch (URISyntaxException e) {\n\t\t\tthrow new ElasticException(\"Error parsing URL: \" + e.getMessage());\n\t\t}\n\t\tcatch (IOException e) {\n\t\t\tthrow new ElasticException(\"Error sending request: \" + e.getMessage());\n\t\t}\n\t\tcatch (JsonParseException e) {\n\t\t\tthrow new ElasticException(\"Error parsing response: \" + e.getMessage());\n\t\t}\n\t\tfinally {\n\t\t\tif (connection != null) {\n\t\t\t\tconnection.disconnect();\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticConnection.java#L351-L387","documentation":"Thrown by executeBulk when the bulk request returns a non-2xx status AND parseErrorJSON cannot recognize the error shape: resp.error is neither a String nor a JsonObject (it is missing, an array, a number, or a boolean). The literal returned string is 'Unknown error format'. The real cause is hidden because the ES error structure was unexpected.","triggerScenarios":"A bulk endpoint that is not standard ES (proxy/gateway returning an error envelope); an ES major-version change that reshaped the bulk error JSON; a partial bulk failure whose error field is an array; a 4xx from a misconfigured bulk path returning a non-ES error document.","commonSituations":"ES 7->8 upgrade changing error envelope shape; a reverse proxy's own JSON error body (e.g. {\"message\":...} with no 'error' key); hitting '_bulk' on a node where the bulk API is disabled.","solutions":["Capture the raw response: temporarily log resp.toString() in a wrapper to see the actual error body, since 'Unknown error format' discards it.","Confirm you are hitting real ES (curl -XPOST <url>/_bulk with a tiny NDJSON) and note the cluster version.","If a proxy injects its own error JSON, route bulk traffic directly to ES or teach the proxy to pass ES errors through unchanged."],"exampleFix":"// before: parseErrorJSON returns 'Unknown error format', cause lost\nJsonObject r = c.executeBulk(\"_bulk\", ndjson);\n// after: wrap to preserve the raw body on failure for diagnosis\nclass BulkProbe { static JsonObject run(ElasticConnection c, String b) throws ElasticException { try { return c.executeBulk(\"_bulk\", b); } catch (ElasticException e) { if (e.getMessage().equals(\"Unknown error format\")) Msg.error(BulkProbe.class, \"raw bulk error body unseen by lib\"); throw e; } } }","handlingStrategy":"try-catch","validationCode":"// No pre-validation possible from outside; capture the raw body via a debug wrapper instead.\npublic static JsonObject bulkWithRawOnError(ElasticConnection c, String ndjson, java.util.function.Consumer<String> rawSink) throws ElasticException {\n    try { return c.executeBulk(\"_bulk\", ndjson); }\n    catch (ElasticException e) {\n        if (e.getMessage().equals(\"Unknown error format\")) rawSink.accept(\"library discarded the raw bulk error body; curl the _bulk endpoint manually to inspect it\");\n        throw e;\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    return conn.executeBulk(path, ndjson);\n} catch (ElasticException e) {\n    if (e.getMessage().equals(\"Unknown error format\")) {\n        // library hid the cause; reproduce with curl -XPOST <url>/_bulk to read the real error\n        throw new IllegalStateException(\"Unrecognized bulk error envelope; inspect ES/proxy response manually\", e);\n    }\n    throw e;\n}","preventionTips":["Pin a known ES major version; bulk error envelopes differ across versions.","Bypass any proxy that substitutes its own error JSON when reproducing the failure.","Keep a curl-based bulk smoke test to interpret 'Unknown error format'."],"tags":["elasticsearch","bulk","server-error","bsim","diagnostics"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}