Query string containing the "/" (forward slash) raises the error "Cannot parse ... Encountered: <EOF>"

Elastic Stack Elasticsearch
1

Hi, I'm encountering the above-mentioned error when I'm searching for a document using:

"query_string": {
    "default_field": "innerId.txt",
    "query": "XMT01/195077567"
}

I'm getting the parse exception error "Cannot parse 'XMT01/195077567': Lexical error at line 1, column 18. Encountered: after : "/195077567".
I've google-it and found out this to be reported previously and suggested by many that one must escape the slash. But this doesn't work for me. If I query for "XMT01\\/195077567" then I get back all the document which innerId field starts with 'XMT01' and that's not right. I need only one document with that exact value.
Furthermore, I need to use the query_string because of all this is nested in a watcher with chain input. The first search gets all the documents that satisfy search criteria, then a lookup extracts all the values that would be used for querying in the next search and put them in a HashSet and finally, the last search is using the above query string for getting the related documents. Obviously, there can be more than one document that we are searching the matching document for.
Here is the simplified code extracted for my watcher:

  "input": {
    "chain": {
      "inputs": [
        {
          "first": {
			/* search for documents that match criteria*/
          }
        },
        {
          "inners_lookup": {
            "transform": {
              "script": {
                "lang": "painless",
                "source": """
                  HashSet inners = new HashSet();
                  for (hit in ctx.payload.first.hits.hits) inners.add(hit._source.extInnerId);
                  return ['innersA' : inners];
                """
              }
            }
          }
        },
        {
          "inners": {
		    /* ... */
			{
			  "query_string": {
				"default_field": "innerId.txt",
				"query": "{{#ctx.payload.inners_lookup.innersA}}'{{.}}' {{/ctx.payload.inners_lookup.innersA}}"
			  }
			}
          }
        }
	  ]
    }
  }

P.S.
I'm on Elasticsaerch version 7.4.2

2

can you provide a full reproduction instead of just snippets, so one can reproduce this locally?

3

Hi and thx for your replay.
Here is the body of my search request:

{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "status": 0
          }
        },
        {
          "term": {
            "transactionType": 3
          }
        },
        {
          "range": {
            "eventTime": {
              "gte": "now-24h"
            }
          }
        },
        {
          "query_string": {
            "default_field": "innerId.txt",
            "query": "XMT01/195077567"
            }
        }
      ]
    }
  }
}

And here is the error I'm recieving

{
  "took" : 1827,
  "timed_out" : false,
  "_shards" : {
    "total" : 56,
    "successful" : 54,
    "skipped" : 0,
    "failed" : 2,
    "failures" : [
      {
        "shard" : 0,
        "index" : ,
        "node" : "Q13JAbZsQL6t9EO_Ef0Xkg",
        "reason" : {
          "type" : "query_shard_exception",
          "reason" : "Failed to parse query [XMT01/195077567]",
          "index_uuid" : "7u1F5GMwTl6ZzFncdowuFA",
          "index" : ,
          "caused_by" : {
            "type" : "parse_exception",
            "reason" : """Cannot parse 'XMT01/195077567': Lexical error at line 1, column 18.  Encountered: <EOF> after : "/195077567"""",
            "caused_by" : {
              "type" : "token_mgr_error",
              "reason" : """Lexical error at line 1, column 18.  Encountered: <EOF> after : "/195077567""""
            }
          }
        }
      }
    ]
  },
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  }
}

I've deleted the index name (I'm being paranoid here :wink: )

Hope this helps!

4

Is this querying a single index? If not: is the innerId.txt field mapped the same in all involved indices?

As you can see in the response, only 2 out of 56 queried shards failed, thus the question.

5

It's querying an alias. We have a hot-warm architecture that is an ILM (index life-cycle policy), and yes the field is mapped same as there is a template involved.

6

Furthermore, if I target a specific index for which I know is holding the document I'm searching for, I got the same error

7

What part of the ILM have those shards run through that are affected? shrinking? merging? what else?

8

The policy has only hot and warm phases without any merging or shrinking involved.
Here is the policy:

{
  "cas_ilm" : {
    "version" : 4,
    "modified_date" : "2020-01-05T07:48:10.127Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "10gb",
              "max_age" : "30d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "warm" : {
          "min_age" : "30d",
          "actions" : {
            "allocate" : {
              "number_of_replicas" : 0,
              "include" : { },
              "exclude" : { },
              "require" : {
                "data" : "warm"
              }
            },
            "set_priority" : {
              "priority" : 50
            }
          }
        }
      }
    }
  }
}
9

Hm, that doesn't look like it's an issue to me. Can you try escaping the slash?

10

Hi again.
As I mentioned in the opening post if I escape the slash char:

        {
          "query_string": {
            "default_field": "innerId.txt",
            "query": "XMT01\\/195077567"
            }
        }

I end up getting all the documents which "innerId" field starts with "XMT01" ?

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.