...
Field | Data type | Description |
---|---|---|
type |
| Error type. Currently, the only type shown is |
component |
| Devo component that is sending the error log (for example:
|
resource_id |
| ID of the resource that is failing. |
severity |
| Severity level of the incident. It can be one of the following:
|
error_code |
| Code of the error. The error code is always composed by a letter that indicates the Devo component plus a number that indicates the issue, following the rules specified in the section below. |
message |
| Definition of the incident. |
...
Code errors
Error codes displayed in this table are always composed of a letter and a number, as in the examples below:
...
The letter indicates the Devo component that is affected. For example:
Q
stands for query.F
stands for flow.A
stands for alerts.I
stands for data ingestion.
...
The first digit of the error code indicates the severity of the issue and informs whether it can be fixed or not.
First digitDigit 1 | Description |
---|---|
| The error cannot be fixed. |
| The error requires manual action over another part of the system. |
| The error can be fixed in a medium-long amount of time. |
| The error can be fixed immediately. |
...
Digits 4-7 | Description |
---|---|
General error | |
| Unknown error. |
Connection error | |
| Affinity rules have changed during query execution and the query can no longer be processed. |
Missing resource | |
| Missing aggregated resource to execute the query (for example, an aggregation task). |
| Missing Recursive definition for a union table. |
| Missing files for Geolocation operations that use MaxMind operations. |
| Missing files for Public suffix operations. |
| Missing files for User agent files cannot be foundoperations. |
| Unknown table. |
System resource error | |
| Required registry for a computation process is missing. |
| Provided registry is not suitable for the required operation. |
| Memory shortage. |
Internal error | |
| Unknown internal error. |
| A listed file cannot be found in the directory, usually because it has been compressed simultaneously. |
| Stall event received while executing a subquery. |
| Error while caching data. |
| Error while updating cached data. |
| Error while deleting cached data segments. |
| Error while deleting cached data entries. |
| Array index out of bounds. |
Query parsing error | |
| No language provided when parsing a query. |
| Query for an unknown Unknown query language. |
| No code provided. It may be used for This error relates to any kind of language, including expressions and Ty Terms. |
| Query starting time no found. |
| Query ending time no found. |
| Cannot parse query. |
| Illegal time-based grouping clause. |
| Time-based group found over a non-time-based table or group. |
| Inferred time constraint spans to the future. |
| Reference to an identifier (table field or as-defined) that is not known or available at that stage. |
| Unknown function operation or known function operation expecting arguments with other properties (type, constancy...) |
| An identifier has been used more than once. |
| An expression with boolean type or a type that can by automatically converted to boolean automatically was expected. |
| Operation The operation expects some arguments to be constant, but a non-constant expression was given. |
| Invalid filter added to an operation. |
| The operation cannot be used with one or several of the given arguments. |
| The operation cannot be used with one or several of the given data types. |
| The operation cannot be used with the given arguments. |
| The operation cannot be called at stage 1. |
| Given argument for the selected operation is ambiguous. |
| Grouping over a key correctly typed but with no computable tyre PR. |
| Grouping over a key correctly typed but with no computable memory usage information. |
| Grouping computing a correctly typed aggregation but with no computable tyre PR. |
| Grouping computing a properly typed aggregation but with no computable memory usage information. |
| Inferred type does not match the explicit type given with the operation. |
Config parsing error | |
| Query is trying to access a file but cannot decode it. |
Query limits | |
| Maximum number of elements surpassed for the selected operation. |
| Stack overflow while processing the query. |
| Error limit reached. The query has failed n consecutive times and is quarantined for the following n minutes. |
Security error | |
| Authentication failed. |
| Cannot change authentication for active cluster. |
...