Skip to content

Bug - Date field used as sort option can crash ES with BigInteger error #48074

@DemonGyro

Description

@DemonGyro

Elasticsearch version (bin/elasticsearch --version): 7.3.1

Plugins installed: [discovery-ec2, repository-s3]

JVM version (java -version):
java version "11.0.4" 2019-07-16 LTS
Java(TM) SE Runtime Environment 18.9 (build 11.0.4+10-LTS)
Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.4+10-LTS, mixed mode)

OS version (uname -a if on a Unix-like system):
Linux XXXXXXXXX 4.15.0-1051-aws #53-Ubuntu SMP Wed Sep 18 13:35:53 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Description of the problem including expected versus actual behavior:
The date value returned in the sort field returned in a document from _search had a value that was invalid. When this was passed back in to the search_after field, this caused the request to fail with a java.lang.AssertionError: Unknown number type []BIG_INTEGER error. With enough errors, this ended up crashing ES. We were seeing this take down an entire cluster with only a couple requests.

The values returned from the sort field of a document from _search are expected to be valid and are expected to not cause crashes in the ES application.

Steps to reproduce:

  1. Create an index that has a date.
PUT _template/test_index
{
  "index_patterns": [
    "test*"
  ],
  "mappings": {
    "test": {
      "properties": {
        "test": {
          "type": "boolean"
        },
        "created": {
          "type": "date"
        }
      }
    }
  }
}
  1. Add about a dozen documents. 8 good, 4 bad.

Good example:

POST /test_0/test
{
  "test": true,
  "created": "2017-12-20T15:42:55.6497236+00:00"
}

Bad example:

POST /test_0/test
{
  "test": true
}
  1. Execute a search on the date field as sort
POST /_search
{
    "query": {
    	"match_all": {}
    },
    "sort": [
        {
            "created": {
                "order": "asc"
            }
        }
    ]
}
  1. If done correctly, the last item in the search should look like this:
{
        "_index": "test_b10",
        "_type": "test",
        "_id": "OSA_0G0BUWBv2lD0FAe4",
        "_score": null,
        "_source": {
          "test": true
        },
        "sort": [
          9223372036854776000
        ]
}
  1. Execute a search with the last item's sort value as the search_after field.
{
    "query": {
        "match_all": {}
    },
    "sort": [
        {
            "created": {
                "order": "asc"
            }
        }
    ],
    "search_after": [
        9223372036854776000
    ]
}
  1. Result from search should be a 500 error.
{
  "error": {
    "root_cause": [
      {
        "type": "illegal_state_exception",
        "reason": "No matching token for number_type [BIG_INTEGER]"
      }
    ],
    "type": "illegal_state_exception",
    "reason": "No matching token for number_type [BIG_INTEGER]"
  },
  "status": 500
}

Stack Trace

[2019-10-10T20:34:56,297][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [ES_NODE_NAME] fatal error in thread [Thread-6470], exiting
java.lang.AssertionError: Unknown number type []BIG_INTEGER
        at org.elasticsearch.search.searchafter.SearchAfterBuilder.fromXContent(SearchAfterBuilder.java:247) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.search.builder.SearchSourceBuilder.parseXContent(SearchSourceBuilder.java:1189) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.rest.action.search.RestSearchAction.parseSearchRequest(RestSearchAction.java:131) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.rest.action.search.RestSearchAction.lambda$prepareRequest$1(RestSearchAction.java:110) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.rest.RestRequest.withContentOrSourceParamParserOrNull(RestRequest.java:449) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.rest.action.search.RestSearchAction.prepareRequest(RestSearchAction.java:109) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:92) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.rest.SecurityRestFilter.handleRequest(SecurityRestFilter.java:69) ~[?:?]
        at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:240) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.rest.RestController.tryAllHandlers(RestController.java:344) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:174) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.http.AbstractHttpServerTransport.dispatchRequest(AbstractHttpServerTransport.java:320) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.http.AbstractHttpServerTransport.handleIncomingRequest(AbstractHttpServerTransport.java:370) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.http.AbstractHttpServerTransport.incomingRequest(AbstractHttpServerTransport.java:299) ~[elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.http.netty4.Netty4HttpRequestHandler.channelRead0(Netty4HttpRequestHandler.java:66) ~[?:?]
        at org.elasticsearch.http.netty4.Netty4HttpRequestHandler.channelRead0(Netty4HttpRequestHandler.java:31) ~[?:?]
        at io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:105) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[?:?]
        at org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.channelRead(Netty4HttpPipeliningHandler.java:58) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[?:?]
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) ~[?:?]
        at io.netty.handler.codec.MessageToMessageCodec.channelRead(MessageToMessageCodec.java:111) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[?:?]
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[?:?]
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[?:?]
        at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:323) ~[?:?]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:297) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[?:?]
        at io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:287) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) ~[?:?]
        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1408) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) ~[?:?]
        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:930) ~[?:?]
        at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:682) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:582) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:536) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:496) ~[?:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:906) ~[?:?]
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]
        at java.lang.Thread.run(Thread.java:835) [?:?]

Metadata

Metadata

Assignees

No one assigned

    Labels

    :Search/SearchSearch-related issues that do not fall into other categories>bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions