What causes "too many redirects connection to [{}]" in elastic/elasticsearch?

Inspect the URL in the message; curl it with -L --max-redirs 60 to see the redirect chain.

elastic/elasticsearch · error · IllegalStateException

too many redirects connection to [{}]

Error message

too many redirects connection to [{}]

What it means

Thrown by HttpClient.get after following more than 50 HTTP 301/302/303 redirects for a single request. The client manually follows redirects (to control auth propagation across authorities); a redirect chain longer than 50 is treated as a loop or a broken endpoint. IllegalStateException propagates as an IOException-adjacent failure of the download.

Source

Thrown at modules/ip-location/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java:98

    InputStream get(final PasswordAuthentication auth, final String url) throws IOException {
        Objects.requireNonNull(auth);
        Objects.requireNonNull(url);

        final String originalAuthority = new URL(url).getAuthority();

        String innerUrl = url;
        HttpURLConnection conn = createConnection(auth, innerUrl);

        int redirectsCount = 0;
        while (true) {
            switch (conn.getResponseCode()) {
                case HTTP_OK:
                    return getInputStream(conn);
                case HTTP_MOVED_PERM:
                case HTTP_MOVED_TEMP:
                case HTTP_SEE_OTHER:
                    if (redirectsCount++ > 50) {
                        throw new IllegalStateException("too many redirects connection to [" + url + "]");
                    }

                    // deal with redirections (including relative urls)
                    final String location = conn.getHeaderField("Location");
                    final URL base = new URL(innerUrl);
                    final URL next = new URL(base, location);
                    innerUrl = next.toExternalForm();

                    // compare the *original* authority and the next authority to determine whether to include auth details.
                    // this means that the host and port (if it is provided explicitly) are considered. it also means that if we
                    // were to ping-pong back to the original authority, then we'd start including the auth details again.
                    final String nextAuthority = next.getAuthority();
                    if (originalAuthority.equals(nextAuthority)) {
                        conn = createConnection(auth, innerUrl);
                    } else {
                        conn = createConnection(NO_AUTH, innerUrl);
                    }
                    break;

View on GitHub (pinned to db6a809a66)

Solutions

Inspect the URL in the message; curl it with -L --max-redirs 60 to see the redirect chain.
Fix or replace the endpoint configuration so it resolves without a loop.
If a proxy is rewriting redirects, bypass or reconfigure it for the geoip download host.
Report to the provider if their endpoint is genuinely looping.

Defensive patterns

Strategy: validation

Try / catch

try {
    InputStream in = httpClient.get(auth, url);
} catch (IllegalStateException e) {
    if (e.getMessage().startsWith("too many redirects")) {
        // curl the URL to inspect the chain; fix endpoint config or bypass redirecting proxy
    } else throw e;
}

Prevention

Pre-resolve endpoint URLs to avoid redirect-heavy hosts.
Do not point geoip downloads at hosts that redirect to themselves or to auth pages that loop.
Watch for proxy-injected redirects and bypass them for the geoip host.
Cap redirect following and log the chain when the cap is hit.

When it happens

Trigger: HttpClient.get(auth, url) loop on HTTP_MOVED_PERM/HTTP_MOVED_TEMP/HTTP_SEE_OTHER increments redirectsCount; once it exceeds 50, IllegalStateException is thrown.

Common situations: Misconfigured endpoint that redirects back to itself; a CDN/auth combo that ping-pongs between two hosts; the originalAuthority vs nextAuthority logic re-including auth and re-triggering an auth redirect; provider outage returning a redirect to a status page that itself redirects.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/82322f5f510baa6b. Report an issue: GitHub.