# Array index out of bounds exception

**URL:** <https://discuss.elastic.co/t/array-index-out-of-bounds-exception/104315>\
**Category:** Elasticsearch\
**Created:** [October 17, 2017, 11:10pm UTC](https://discuss.elastic.co/t/array-index-out-of-bounds-exception/104315 "2017-10-17T23:10:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\
**Post date:** [October 17, 2017, 11:10pm UTC](https://discuss.elastic.co/t/array-index-out-of-bounds-exception/104315/1 "2017-10-17T23:10:51Z")

</div>

Hi,

I have a query that does an aggregation using a groovy script that when the query returns a large number of documents fails with an array\_index\_out\_of\_bounds\_exception. Here's the query:

```
GET logstash-java-megatron-hrp-*/_search
{
      "query": {
        "bool": {
          "must_not": [
            {
              "wildcard": {
                "class": "*dataquality*"
              }
            },
            {
              "wildcard": {
                "class": "*DataQuality*"
              }
            }
          ],
          "filter": {
            "and": [
              {
                "match": {
                  "loglevel": "ERROR"
                }
              },
              {
                "prefix": {
                  "beat.hostname.raw": "eip-a1-p"
                }
              },
              {
                "range": {
                  "@timestamp": {
                    "gte": "now-16h",
                    "lte": "now"
                  }
                }
              }
            ]
          }
        }
      },
      "aggs": {
        "classes": {
          "terms": {
            "field": "class.raw"
          },
          "aggs": {
            "messages": {
              "terms": {
                "script": {
                  "lang": "groovy",
                  "inline": "String[] msgs = _source.logmessage.split(\"[^\\\\S]+\"); msgs[0] + \"\\n\" + msgs[1]"
                }
              }
            }
          }
        }
      }
    }

```

Here's the error I get back when there's a large number of documents:

```
{
  "took": 84,
  "timed_out": false,
  "_shards": {
    "total": 150,
    "successful": 144,
    "failed": 6,
    "failures": [
      {
        "shard": 0,
        "index": "logstash-java-megatron-hrp-2017.10.16",
        "node": "R2SE6NTCQq6nrrSPHXytWQ",
        "reason": {
          "type": "script_exception",
          "reason": "failed to run inline script [String[] msgs = _source.logmessage.split(\"[^\\\\S]+\"); msgs[0] + \"\\n\" + msgs[1]] using lang [groovy]",
          "caused_by": {
            "type": "array_index_out_of_bounds_exception",
            "reason": "1"
          }
        }
      }
    ]
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "classes": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": []
    }
  }
}

```

Intention is to aggregate by the first line of the log as some are multi-line (stack traces). I didn't write the query but I did help the person who did. Is there a better way? I'm running ES v2.4.1 currently.

---

<div class="post-metadata">

**Author:** ![Jerry\_Hoffmeister](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\
**Post date:** [October 17, 2017, 11:31pm UTC](https://discuss.elastic.co/t/array-index-out-of-bounds-exception/104315/2 "2017-10-17T23:31:51Z")

</div>

And one thing I don't understand - if I construct the query such that it doesn't cover the time period where there were many events (should only have one hit) it still fails with the same error. If I remove the aggregation, I only get one result.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2017, 11:32pm UTC](https://discuss.elastic.co/t/array-index-out-of-bounds-exception/104315/3 "2017-11-14T23:32:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.