Null Pointer Exception when querying with wildcard paths

[mobinnazari]

Elasticsearch Version

9.0.0

Installed Plugins

No response

Java Version

bundled

OS Version

Linux 6.1.0-33-amd64 Debian x86_64

Problem Description

I encountered a Null Pointer Exception when executing a query with a wildcard path on my Elasticsearch cluster. The query is as follows:

"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\root\\d8f8dbc2\\1beb9918\\assembly\\tmp\\4YXWQNBI\\*"

Error Details:
The error message indicates issues with multiple shards and the following response:

{
  "id": "FjJ2cUtuczhoVHJlenRrZnZ2Y1lnSUEgUUo3S2lkdExSM3E3bWg4NVFhdlpndzoxMDI5OTg0MjM=",
  "isPartial": false,
  "isRunning": false,
  "rawResponse": {
    "took": 1184,
    "timed_out": false,
    "_shards": {
      "total": 85,
      "successful": 82,
      "skipped": 34,
      "failed": 3,
      "failures": [
        {
          "shard": 0,
          "index": ".ds-logs-endpoint.alerts-default-2025.04.21-000028",
          "node": "QJ7KidtLR3q7mh85QavZgw",
          "reason": {
            "type": "null_pointer_exception",
            "reason": "Cannot invoke \"org.apache.lucene.search.ScorerSupplier.get(long)\" because the return value of \"org.elasticsearch.index.mapper.extras.SourceConfirmedTextQuery$2.scorerSupplier(org.apache.lucene.index.LeafReaderContext)\" is null"
          }
        },
        {
          "shard": 0,
          "index": ".ds-logs-endpoint.events.file-default-2025.04.13-000030",
          "node": "QJ7KidtLR3q7mh85QavZgw",
          "reason": {
            "type": "null_pointer_exception",
            "reason": "Cannot invoke \"org.apache.lucene.search.ScorerSupplier.get(long)\" because the return value of \"org.elasticsearch.index.mapper.extras.SourceConfirmedTextQuery$2.scorerSupplier(org.apache.lucene.index.LeafReaderContext)\" is null"
          }
        },
        {
          "shard": 0,
          "index": ".ds-logs-endpoint.events.file-default-2025.04.20-000032",
          "node": "QJ7KidtLR3q7mh85QavZgw",
          "reason": {
            "type": "null_pointer_exception",
            "reason": "Cannot invoke \"org.apache.lucene.search.ScorerSupplier.get(long)\" because the return value of \"org.elasticsearch.index.mapper.extras.SourceConfirmedTextQuery$2.scorerSupplier(org.apache.lucene.index.LeafReaderContext)\" is null"
          }
        }
      ]
    },
    "hits": {
      "max_score": null,
      "hits": []
    }
  },
  "warning": null,
  "isRestored": true,
  "total": 85,
  "loaded": 85
}

Steps to Reproduce:

1. Run the provided query against the specified indices.
2. Observe the error returned.

Expected Behavior:
The query should return the expected result without errors.

Actual Behavior:
a null_pointer_exception is thrown, resulting in incomplete results.

Please let me know if you need any further information or if there are steps I can take to assist in resolving this issue.

Steps to Reproduce

1. Run the provided query against the specified indices.
2. Observe the error returned.

Logs (if relevant)

No response

[elasticsearchmachine]

Pinging @elastic/es-search (Team:Search)

[cbuescher]

Looks like a duplicate of #125635 which has an incoming fix in #127414. @benwtrent maybe you can confirm, then we can close this as a duplicate?

[benwtrent]

@cbuescher yes, it seems to be the same thing kibana is requesting highlighting and that will utilize the matches API and hit the problematic code path.