Debug.explain kills Elasticsearch

[toughcoding]

Elasticsearch Version

8.11.3

Installed Plugins

No response

Java Version

bundled

OS Version

Linux 693c13e45c65 6.4.16-linuxkit #1 SMP PREEMPT Thu Nov 16 10:49:20 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

Problem Description

When calling Debug.explain API it cause error and kill Elasticsearch instance.

Steps to Reproduce

103777_Debug_explain_kills_Elasticsearch.txt

Start Elasticsearch node

docker run \ --name elk01 \ -e node.name="elk01" \ -p 9200:9200 \ docker.elastic.co/elasticsearch/elasticsearch:8.11.3

Setup example password

docker exec -it elk01 bash -c "(mkfifo pipe1); ( (elasticsearch-reset-password -u elastic -i < pipe1) & ( echo $'y\n123456\n123456' > pipe1) );sleep 5;rm pipe1"

load test data

curl -k -u elastic:123456 -XPOST "https://localhost:9200/fruits/_bulk" \ -H 'content-type: application/json' -d' {"index":{"_id":"1"}} {"name_base64":"QXBwbGU=","color_hex":"477265656e"} {"index":{"_id":"2"}} {"name_base64":"QW5hbmFz","color_hex":"59656c6c6f77"} {"index":{"_id":"3"}} {"name_base64":"Q2hlcnJ5","color_hex":"526564"}

Use debug Explain

curl -k -u elastic:123456 -XGET "https://localhost:9200/fruits/_search?pretty" \ -H 'content-type: application/json' -d' { "query": { "bool": { "filter": { "script": { "script": { "source": "Debug.explain($(params.field,\"\"))", "params": { "field": "name_base64.keyword", "filteronvalue": "Apple" } } } } } } }'

Logs (if relevant)

{ "@timestamp": "2024-01-02T01:18:01.368Z", "log.level": "ERROR", "message": "fatal error in thread [elasticsearch[elk01][search_worker][T#1]], exiting", "ecs.version": "1.2.0", "service.name": "ES_ECS", "event.dataset": "elasticsearch.server", "process.thread.name": "elasticsearch[elk01][search_worker][T#1]", "log.logger": "org.elasticsearch.bootstrap.ElasticsearchUncaughtExceptionHandler", "elasticsearch.cluster.uuid": "ugbWxHNTTDSp2S2CjIGgOw", "elasticsearch.node.id": "7FwCyEVxS2C6OMAfP_CcMw", "elasticsearch.node.name": "elk01", "elasticsearch.cluster.name": "docker-cluster", "error.type": "org.elasticsearch.painless.PainlessExplainError", "error.stack_trace": "org.elasticsearch.painless.PainlessExplainError\n\tat org.elasticsearch.painless@8.11.3/org.elasticsearch.painless.api.Debug.explain(Debug.java:23)\n\tat org.elasticsearch.painless.PainlessScript$Script.execute(Debug.explain($(params.field,\"\")):15)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.index.query.ScriptQueryBuilder$ScriptQuery$1$1.matches(ScriptQueryBuilder.java:194)\n\tat org.apache.lucene.core@9.8.0/org.apache.lucene.search.ConstantScoreScorer$1.matches(ConstantScoreScorer.java:107)\n\tat org.apache.lucene.core@9.8.0/org.apache.lucene.search.Weight$DefaultBulkScorer.scoreRange(Weight.java:295)\n\tat org.apache.lucene.core@9.8.0/org.apache.lucene.search.Weight$DefaultBulkScorer.score(Weight.java:236)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.search.internal.CancellableBulkScorer.score(CancellableBulkScorer.java:45)\n\tat org.apache.lucene.core@9.8.0/org.apache.lucene.search.BulkScorer.score(BulkScorer.java:38)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.search.internal.ContextIndexSearcher.searchLeaf(ContextIndexSearcher.java:536)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.search.internal.ContextIndexSearcher.search(ContextIndexSearcher.java:460)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.search.internal.ContextIndexSearcher.lambda$search$4(ContextIndexSearcher.java:375)\n\tat java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:33)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:983)\n\tat org.elasticsearch.server@8.11.3/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)\n\tat java.base/java.lang.Thread.run(Thread.java:1583)\n" }

[DaveCTurner]

Duplicates #103018; we expect 8.12.0 to include the fix.