elastic/elasticsearch · error · ElasticsearchStatusException
error during downloading {}
Error message
error during downloading {} What it means
Thrown by HttpClient.get for any HTTP response code that is not 200, a redirect (301/302/303), or 404. It is an ElasticsearchStatusException whose RestStatus is derived from the actual response code, so 403, 429, 500, etc. each carry the correct status. This is the catch-all download failure for non-success, non-redirect, non-not-found responses.
Source
Thrown at modules/ip-location/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java:121
final URL base = new URL(innerUrl);
final URL next = new URL(base, location);
innerUrl = next.toExternalForm();
// compare the *original* authority and the next authority to determine whether to include auth details.
// this means that the host and port (if it is provided explicitly) are considered. it also means that if we
// were to ping-pong back to the original authority, then we'd start including the auth details again.
final String nextAuthority = next.getAuthority();
if (originalAuthority.equals(nextAuthority)) {
conn = createConnection(auth, innerUrl);
} else {
conn = createConnection(NO_AUTH, innerUrl);
}
break;
case HTTP_NOT_FOUND:
throw new ResourceNotFoundException("{} not found", url);
default:
int responseCode = conn.getResponseCode();
throw new ElasticsearchStatusException("error during downloading {}", RestStatus.fromCode(responseCode), url);
}
}
}
@SuppressForbidden(reason = "we need socket connection to download data from internet")
private static InputStream getInputStream(final HttpURLConnection conn) throws IOException {
return conn.getInputStream();
}
private static HttpURLConnection createConnection(final PasswordAuthentication auth, final String url) throws IOException {
final HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection();
if (auth != NO_AUTH) {
conn.setAuthenticator(new Authenticator() {
protected PasswordAuthentication getPasswordAuthentication() {
return auth;
}
});
}View on GitHub (pinned to db6a809a66)
Solutions
- Read the RestStatus in the exception: 401/403 -> fix credentials, 429 -> slow down / check quota, 5xx -> retry later.
- For auth errors, update the license key/token in secure settings and reload.
- For 429, reduce download frequency or confirm quota with the provider.
- For 5xx, wait and retry; check the provider status page.
- If a proxy returns 5xx, bypass or reconfigure it for the geoip host.
Defensive patterns
Strategy: try-catch
Try / catch
try {
InputStream in = httpClient.get(auth, url);
} catch (ElasticsearchStatusException e) {
switch (e.status()) {
case UNAUTHORIZED, FORBIDDEN -> updateCredentialsAndReload();
case TOO_MANY_REQUESTS -> backoffAndRetry();
default -> { if (e.status().getStatus() >= 500) retryLater(); else throw e; }
}
} Prevention
- Keep credentials valid and within quota.
- Apply backoff for 429 responses rather than hammering the provider.
- Bypass proxies that emit 5xx for the geoip host.
- Map RestStatus to a retry/no-retry decision explicitly.
When it happens
Trigger: HttpClient.get switch default case -> throw new ElasticsearchStatusException("error during downloading {}", RestStatus.fromCode(responseCode), url). Typical for 401/403 (auth), 429 (rate limit), 5xx (provider outage).
Common situations: Invalid/expired credentials (401/403); exceeding the provider rate limit or download quota (429); provider-side outage (5xx); geo-blocked IP returning 403; corporate proxy returning 502/504.
Related errors
- too many redirects connection to [{}]
- {} not found
- Failed to download branches.json from: {}
- checksum mismatch, expected [{}], actual [{}]
- md5 checksum mismatch, expected [{}], actual [{}]
AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12).
Data as JSON: /api/errors/fa480f82a5ffc6f1.
Report an issue: GitHub.