Elasticsearch Version
main
Installed Plugins
No response
Java Version
bundled
OS Version
serverless
Problem Description
When Lucene throws on an overly complex regex in the ESQL regex logic, we return that error directly to the user as a 5xx class error. This should be a 4xx class user error. We do not want the user to retry the query, and this exception does not indicate an issue in Elasticsearch, so a 500 is inappropriate. 500s also trigger alerting in our monitoring, and we would like to avoid alerting on non-actionable errors or user errors.
I think it would be sufficient to catch this exception and report the error in a more user friendly way.
Steps to Reproduce
I didn't reproduce it. I suspect any overly-complex regular expression would do the trick.
Logs (if relevant)
Stack Trace:
org.apache.lucene.util.automaton.TooComplexToDeterminizeException: Determinizing automaton with 261 states and 1223 transitions would require more than 10000 effort.
at org.apache.lucene.core@10.2.2/org.apache.lucene.util.automaton.Operations.determinize(Operations.java:727)
at org.elasticsearch.xpack.esql.core.expression.predicate.regex.WildcardPatternList.createAutomaton(WildcardPatternList.java:57)
at org.elasticsearch.xpack.esql.core.expression.predicate.regex.AbstractStringPattern.automaton(AbstractStringPattern.java:23)
at org.elasticsearch.xpack.esql.core.expression.predicate.regex.AbstractStringPattern.matchesAll(AbstractStringPattern.java:30)
at org.elasticsearch.xpack.esql.optimizer.rules.logical.ReplaceRegexMatch.rule(ReplaceRegexMatch.java:31)
at org.elasticsearch.xpack.esql.optimizer.rules.logical.ReplaceRegexMatch.rule(ReplaceRegexMatch.java:19)
at org.elasticsearch.xpack.esql.optimizer.rules.logical.OptimizerRules$OptimizerExpressionRule.lambda$apply$0(OptimizerRules.java:62) at
Elasticsearch Version
main
Installed Plugins
No response
Java Version
bundled
OS Version
serverless
Problem Description
When Lucene throws on an overly complex regex in the ESQL regex logic, we return that error directly to the user as a 5xx class error. This should be a 4xx class user error. We do not want the user to retry the query, and this exception does not indicate an issue in Elasticsearch, so a 500 is inappropriate. 500s also trigger alerting in our monitoring, and we would like to avoid alerting on non-actionable errors or user errors.
I think it would be sufficient to catch this exception and report the error in a more user friendly way.
Steps to Reproduce
I didn't reproduce it. I suspect any overly-complex regular expression would do the trick.
Logs (if relevant)
Stack Trace: