{"record":{"id":"0cd14a61ffa3575f","repo":"elastic/elasticsearch","slug":"unsupported-ecs-compatibility-mode-0cd14a","errorCode":null,"errorMessage":"unsupported ECS compatibility mode [{}]","messagePattern":"unsupported ECS compatibility mode \\[(.+?)\\]","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/GrokProcessorGetAction.java","lineNumber":174,"sourceCode":"    @ServerlessScope(Scope.PUBLIC)\n    public static class RestAction extends BaseRestHandler {\n\n        @Override\n        public List<Route> routes() {\n            return List.of(new Route(GET, \"/_ingest/processor/grok\"));\n        }\n\n        @Override\n        public String getName() {\n            return \"ingest_processor_grok_get\";\n        }\n\n        @Override\n        protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) {\n            boolean sorted = request.paramAsBoolean(\"s\", false);\n            String ecsCompatibility = request.param(\"ecs_compatibility\", GrokProcessor.DEFAULT_ECS_COMPATIBILITY_MODE);\n            if (GrokBuiltinPatterns.isValidEcsCompatibilityMode(ecsCompatibility) == false) {\n                throw new IllegalArgumentException(\"unsupported ECS compatibility mode [\" + ecsCompatibility + \"]\");\n            }\n            Request grokPatternsRequest = new Request(sorted, ecsCompatibility);\n            return channel -> client.executeLocally(INSTANCE, grokPatternsRequest, new RestToXContentListener<>(channel));\n        }\n    }\n}\n","sourceCodeStart":156,"sourceCodeEnd":181,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/GrokProcessorGetAction.java#L156-L181","documentation":"Thrown by GrokProcessorGetAction.prepareRequest when the ecs_compatibility query parameter is not one of the valid modes accepted by GrokBuiltinPatterns.isValidEcsCompatibilityMode. The REST handler validates the parameter before forwarding the request to the grok patterns retrieval action. IllegalArgumentException surfaced as a 400-style REST error.","triggerScenarios":"Calling GET _ingest/processor/grok with ?ecs_compatibility=bogus or an unsupported value like \"disabled\" or \"v0\".","commonSituations":"User typos the parameter value, follows outdated docs referencing a deprecated mode, or attempts a custom ECS mode that the version doesn't support.","solutions":["Omit ecs_compatibility to use the default (GrokProcessor.DEFAULT_ECS_COMPATIBILITY_MODE).","Use one of the valid modes returned by GrokBuiltinPatterns.isValidEcsCompatibilityMode (typically 'disabled' and 'v1'/'v8' depending on version).","Upgrade or align client tooling to the server version's supported modes."],"exampleFix":"# before\ncurl 'localhost:9200/_ingest/processor/grok?ecs_compatibility=v99'\n# after\ncurl 'localhost:9200/_ingest/processor/grok?ecs_compatibility=v8'","handlingStrategy":"validation","validationCode":"String ecs = request.param(\"ecs_compatibility\", GrokProcessor.DEFAULT_ECS_COMPATIBILITY_MODE);\nif (!GrokBuiltinPatterns.isValidEcsCompatibilityMode(ecs)) {\n    // reject request early with a 400 listing valid modes\n}","typeGuard":"static boolean isValidEcsMode(String s) {\n    return GrokBuiltinPatterns.isValidEcsCompatibilityMode(s);\n}","tryCatchPattern":null,"preventionTips":["Document the supported ecs_compatibility modes in your client tooling.","Default to omitting the parameter if unsure.","Add a client-side enum/check for the parameter to catch typos before sending."],"tags":["ingest","grok","rest","ecs","configuration"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}