---
title: "Search monitoring (error codes)"
canonical: "https://docs.devo.com/space/latest/662470667/Search%20monitoring%20(error%20codes)"
format: markdown
---
[ [Error codes](https://devodocs.atlassian.net/wiki/spaces/latest/pages/662470667/Search+monitoring+error+codes#Code-errors) ] [ [Specific codes for the query engine](https://devodocs.atlassian.net/wiki/spaces/latest/pages/662470667/Search+monitoring+error+codes#Specific-codes-for-the-query-engine) ] [ [Specific error codes for Data Search](https://devodocs.atlassian.net/wiki/spaces/latest/pages/662470667/Search+monitoring+error+codes#Specific-error-codes-for-Data-Search) ]

## Query error codes

Error codes displayed in the `devo.internal.log.error` table are always composed of a letter and a number, as in the examples below:

- `Q-1103001` → `Q` stands for *query.*

### Number

The **number** indicates the error type. This number may be composed either of 3 or 7 digits.

#### Digit 1: Recoverability

Indicates the severity of the issue and informs whether it can be fixed or not.

| **Digit 1** | **Recoverable** | **Description** |
| --- | --- | --- |
| `1` | NO | The error cannot be fixed. |
| `2` | MANUAL | The error requires manual action over another part of the system. |
| `3` | MAYBE | The error can be fixed in a medium-long amount of time. |
| `4` | YES | The error can be fixed immediately. |

#### Digit 2-3: Kind

Kind of exception retrieved.

| **Digits 2-3** | **Kind** | **Description** |
| --- | --- | --- |
| `00` | UNKNOWN | General error. |
| `01` | CONNECTION_ERROR | Connection error. It may be a transient issue. |
| `02` | EXTERNAL_ERROR | An error related to external factors, such as client’s code. |
| `03` | SYSTEM_RESOURCE | An error related to a system-wide resource, such as RAM or file handlers. |
| `04` | SECURITY_ERROR | An error related to a resource that requires additional security checks, such as signed queries. |
| `05` | QUERY_CANCELLED | Query cancelled by an external entity. |
| `06` | CONFIG_PARSING_ERROR | Format error on reading input resources, such as files, fields, decoding… |
| `07` | INTERNAL_ERROR | Internal error. This is not a transient issue, and can be induced by a non-deterministic event. |
| `08` | MISSING_RESOURCE | A resource required to execute the query is missing. |
| `09` | QUERY_LIMIT | Query limit reached (for example, maximum result rows, time, RAM…) |
| `10` | QUERY_PARSING_ERROR | Syntax error in the query, probably a missing or misspelled token.<br>Includes errors found in static analysis performed after parsing (refinement order, unknown operations, operations with unexpected arguments…) |
| `11` | UNSUPPORTED_FEATURE | Unsupported or not implemented feature. |

#### Digit 4-7: Specific error

The last 4 digits of the code are used to specify the detailed error of the exception. This detailed description is associated to the error type indicated by digits 2-3 explained above.

| **Digits 4-7** | **Description** |
| --- | --- |
| **00 General error** |
| `0000` | Unknown error. |
| **01 Connection error** |
| `4000` | `AFFINITY_RULES_CHANGED`: Affinity rules have changed during query execution and the query can no longer be processed. |
| **03 System resource error** |
| `1001` | `UNAVAILABLE_REGISTRY`: Required registry for a computation process is missing. |
| `1002` | `UNSUITABLE_REGISTRY`: Provided registry is not suitable for the required operation. |
| `1003` | `MEMORY_SHORTAGE`: Memory shortage. |
| **04 Security error** |
| `0001` | `AUTH_FAILED`: Authentication failed. |
| `0002` | `CANNOT_CHANGE_AUTH_FOR_ACTIVE_CLUSTER`: Cannot change authentication for active cluster. |
| **06 Config parsing error** |
| `4000` | `INVALID_SEGMENT_FILE`: Query is trying to access a file but cannot decode it. |
| **07 Internal error** |
| `0000` | `UNKNOWN_INTERNAL_ERROR`: Unknown internal error. |
| `0001` | `LOGFILE_LISTED_BUT_NOT_FOUND`: A listed file cannot be found in the directory, usually because it has been compressed simultaneously. |
| `0002` | `STALL_FOUND_IN_A_HOOK`: Stall event received while executing a [subquery](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95191366). |
| `4001` | `CANNOT_CREATE_ENTRY`: Error while caching data. |
| `4002` | `CANNOT_UPDATE_CACHE_DB`: Error while updating cached data. |
| `4003` | `CANNOT_DELETE_SEGMENTS`: Error while deleting cached data segments. |
| `4004` | `CANNOT_DELETE_ENTRY`: Error while deleting cached data entries. |
| `4005` | `INDEX_OUT_OF_BOUNDS`: Array index out of bounds. |
| **08 Missing resource** |
| `1000` | `MISSING_PREAGGREGATED_DATA`: Missing aggregated resource to execute the query (for example, an [aggregation task](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763942)). |
| `2000` | `RECURSIVE_UNION_TABLE`: Recursive definition for a [union table](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95125981). |
| `3000` | `MISSING_MAXMIND_FILES`: Missing files for [Geolocation operations](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95195950) that use MaxMind. |
| `4000` | `MISSING_PUBLICSUFFIX_FILES`: Missing files for [Public suffix operations](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95201784). |
| `5000` | `MISSING_USERAGENT_FILES`: Missing files for [User agent operations](https://devodocs.atlassian.net/wiki/spaces/latest/pages/526155818). |
| `6000` | `UNKNOWN_TABLE`: Unknown table. |
| **09 Query limits** |
| `0001` | `MAXIMUM_NUMBER_SURPASSED`: Maximum number of elements surpassed for the selected operation. |
| `0002` | `STACK_OVERFLOW`: Stack overflow while processing the query. |
| `0003` | `FAILED_TOO_MANY_TIMES`: Error limit reached. The query has failed n consecutive times and is quarantined for the following n minutes. |
| `0004` | `REGEX_OPERATIONS_SURPASSED`: Regular expression surpassed a safe limit |
| **10 Query parsing error** |
| `0001` | `ABSENT_LANGUAGE`: No language provided when parsing a query. |
| `0002` | `UNKNOWN_LANGUAGE`: Unknown query language. |
| `0003` | `ABSENT_CODE`: No code provided. This error relates to any kind of language, including expressions and Ty Terms. |
| `0004` | `NO_STARTING_TIME`: Query starting time no found. |
| `0005` | `NO_ENDING_TIME`: Query ending time no found. |
| `0006` | `CANNOT_PARSE_QUERY`: Cannot parse query. |
| `0007` | `ILLEGAL_TEMPORAL_GROUP_CLAUSE`: Illegal time-based grouping clause. |
| `0008` | `WRONG_TEMPORAL_GROUP`: Time-based group found over a non-time-based table or group. |
| `0009` | `FUTURE_TIME`: Inferred time constraint spans to the future. |
| `1001` | `UNKNOWN_ID`: Reference to an identifier (table field or as-defined) that is not known or available at that stage. |
| `1002` | `UNKNOWN_FUNCTION`: Unknown operation or known operation expecting arguments with other properties (type, constancy...) |
| `1003` | `REDEFINED_ID`: An identifier has been used more than once. |
| `1004` | `BOOLEAN_EXPECTED`: An expression with *boolean* type or a type that can by automatically converted to *boolean* was expected. |
| `1005` | `CONSTANT_ARGUMENT_EXPECTED`: The operation expects some arguments to be constant, but a non-constant expression was given. |
| `1006` | `INVALID_FILTER`: Invalid filter added to an operation. |
| `1007` | `UNKNOWN_FUNCTION_ARITY`: The operation cannot be used with one or several of the given arguments. |
| `1008` | `UNKNOWN_FUNCTION_TYPES`: The operation cannot be used with one or several of the given data types. |
| `1009` | `UNKNOWN_FUNCTION_ARGUMENTS`: The operation cannot be used with the given arguments. |
| `1010` | `UNKNOWN_FUNCTION_STAGE`: The operation cannot be called at stage 1. |
| `1011` | `AMBIGUOUS_OPERATION`: Given argument for the selected operation is ambiguous. |
| `3000` | `GROUP_KEY_WITHOUT_TYPE_INFO`: Grouping over a key correctly typed but with no computable tyre PR. |
| `3001` | `GROUP_KEY_WITHOUT_MEMORY_INFO`: Grouping over a key correctly typed but with no computable memory usage information. |
| `3002` | `GROUP_AGGR_WITHOUT_TYPE_INFO`: Grouping computing a correctly typed aggregation but with no computable tyre PR. |
| `3003` | `GROUP_AGGR_WITHOUT_MEMORY_INFO`: Grouping computing a properly typed aggregation but with no computable memory usage information. |
| `9000` | `INFERRED_TYPE_MISMATCH`: Inferred type does not match the explicit type given with the operation. |

## Specific codes for the query engine 

| **Code** | **Recoverable**<br>(digit 1) | **Kind**<br>(digit 2-3) | **Specific Error**<br>(digits 4-7) | **Detail** |
| --- | --- | --- | --- | --- |
| `1000000` | NO | OTHER | UNKNOWN | Unknown internal error. |
| `1031001` | NO | SYSTEM_RESOURCE | UNAVAILABLE_REGISTRY | Required registry for a computation process is missing. |
| `1031002` | NO | SYSTEM_RESOURCE | UNSUITABLE_REGISTRY | Provided registry is not suitable for the required operation. |
| `1090001` | NO | QUERY_LIMIT | MAXIMUM_NUMBER_SURPASSED | Maximum number of elements surpassed for the selected operation. |
| `110` | NO | QUERY_PARSING_ERROR | `Error Launching Query` | This is a generic error, but here is a compilation of reasons that may help you debug:<br>- If you have a regex that includes curly brackets, escape them (change `re(".: ({.})")` for `re(".: (\\{.\\})")` ) |
| `1100006` | NO | QUERY_PARSING_ERROR | CANNOT_PARSE_QUERY | Invalid filter added to an operation. Check your query carefully. Usually, this happens when the query is not syntactically correct (like missing a *select* statement) |
| `1101001` | NO | QUERY_PARSING_ERROR | UNKNOWN_ID | Reference to an identifier (table field or `as`-defined) that is not known or available at that stage. If you see this error in a *my.synthesis* table, check the availability of the underlying tables.    
  
Causes include:<br>Use of an identifier that is never defined.<br>Use of an identifier before it is defined.<br>Use of an identifier with a `group` and an aggregation not compatible with the type.<br>Use of an identifier after a `group` with an operation that is not an aggregation.<br>Use of an operation name as an identifier. |
| `1101004` | NO | QUERY_PARSING_ERROR | BOOLEAN_EXPECTED | An expression with *boolean* type or a type that can by automatically converted to *boolean* was expected. |
| `1101005` | NO | QUERY_PARSING_ERROR | CONSTANT_ARGUMENT_EXPECTED | The operation expects some arguments to be constant, but a non-constant expression was given. |
| `1101008` | NO | QUERY_PARSING_ERROR | UNKNOWN_FUNCTION_TYPES | The operation cannot be used with one or several of the given data types.  If you see this error in a *my.synthesis* table, check the availability of the underlying tables |
| `2014000` | MANUAL | CONNECTION_ERROR | AFFINITY_RULES_CHANGED | Affinity rules have changed during query execution and the query can no longer be processed. |
| `2040001` | MANUAL | SECURITY_ERROR | AUTH_FAILED | Authentication failed. |
| `2040002` | MANUAL | SECURITY_ERROR | CANNOT_CHANGE_AUTH_FOR_ACTIVE_CLUSTER | Cannot change authentication for active cluster. |
| `2064000` | MANUAL | CONFIG_PARSING_ERROR | INVALID_SEGMENT_FILE | Invalid cached data. |
| `2074004` | MANUAL | INTERNAL_ERROR | CANNOT_DELETE_ENTRY | Error while deleting cached data. |
| `2081000` | MANUAL | MISSING_RESOURCE | MISSING_PREAGGREGATED_DATA | Missing aggregated resource to execute the query (for example, an [aggregation task](https://docs.devo.com/space/latest/94763942)). |
| `2082000` | MANUAL | MISSING_RESOURCE | RECURSIVE_UNION_TABLE | Recursive definition for a [union table](https://docs.devo.com/space/latest/95125981). |
| `2083000` | MANUAL | MISSING_RESOURCE | MISSING_MAXMIND_FILES | Missing files for [Geolocation operations](https://docs.devo.com/space/latest/95195950) that use MaxMind |
| `2084000` | MANUAL | MISSING_RESOURCE | MISSING_PUBLICSUFFIX_FILES | Missing files for [Public suffix operations](https://docs.devo.com/space/latest/95201784). |
| `2085000` | MANUAL | MISSING_RESOURCE | MISSING_USERAGENT_FILES | Missing files for [User agent operations](https://docs.devo.com/space/latest/526155818). |
| `2086000` | MANUAL | MISSING_RESOURCE | UNKNOWN_TABLE | Unknown table. |
| `3031003` | MAYBE | SYSTEM_RESOURCE | MEMORY_SHORTAGE | Insufficient memory to continue the execution of the query. |
| `4014001` | YES | CONNECTION_ERROR | NO_CANDIDATE_SUITABLE | Affinity rules have changed during query execution and the query can no longer be processed. |
| `4070001` | YES | INTERNAL_ERROR | LOGFILE_LISTED_BUT_NOT_FOUND | A listed file cannot be found in the directory, usually because it has been compressed simultaneously. |
| `401` | YES | CONNECTION_ERROR | - | Query engine: Unexpected error |

## Specific error codes for Data Search 

These errors are specific to Data Search and not the Query Engine. The same query from Activeboards or Query Api might work fine.

| **Code** | **Recoverable**<br>(digit 1) | **Kind**<br>(digit 2-3) | **Specific Error**<br>(digits 4-7) | **Detail** |
| --- | --- | --- | --- | --- |
| `400` |  | EVENTS_MS_LIMIT_EXCEEDED | - | Data Search error |
| `401` | YES | EPOCH_NOT_EXPECTED | - | Data Search error |
| `402` |  | PARTIAL_DATA | - | Data Search error |
| `403` |  | BYTE_SIZE_LIMIT | - | Data Search error |
| `404` |  | BYTE_SIZE_PER_VALUE_LIMIT | - | Data Search error |
| `410` |  | ERWIN_SEARCH_FOUND | - | Data Search error |
| `412` |  | ERWIN_SEARCH_NOT_FOUND | - | Data Search error |
| `421` |  | MESSAGE_TOO_BIG | - | Data Search error |
| `500` | NO | INTERNAL_ERROR | - | Data Search error |
| `501` | NO | SQL_ERROR | - | Data Search error |
| `502` |  | MALOTE_ERROR | - | Data Search error |
| `550` |  | CONNECTION_ERROR | - | Data Search error |
| `600` | NO | QUERY_NOT_FOUND | - | Data Search error |
| `601` |  | DATEINTERVAL_SPEC | - | Data Search error |
| `602` |  | DATEINTERVAL_DATES | - | Data Search error |
| `603` |  | COVERAGE | - | Data Search error |
| `604` |  | IGNORED | - | Data Search error |
| `605` |  | UNKNOWN_TABLE | - | Data Search error |