{"record":{"id":"5376c6a25095e87f","repo":"elastic/elasticsearch","slug":"unable-to-parse","errorCode":null,"errorMessage":"unable to parse {} [{}]","messagePattern":"unable to parse (.+?) \\[(.+?)\\]","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java","lineNumber":281,"sourceCode":"        return new byte[] { (byte) (num >> 8), (byte) num };\n    }\n\n    /**\n     * Attempts to coerce an object to an integer\n     */\n    private static int parseIntFromObjectOrString(Object o, String fieldName) {\n        if (o == null) {\n            return 0;\n        } else if (o instanceof Number number) {\n            return number.intValue();\n        } else if (o instanceof String string) {\n            try {\n                return Integer.parseInt(string);\n            } catch (NumberFormatException e) {\n                // fall through to IllegalArgumentException below\n            }\n        }\n        throw new IllegalArgumentException(\"unable to parse \" + fieldName + \" [\" + o + \"]\");\n    }\n\n    public static final class Factory implements Processor.Factory {\n\n        static final String DEFAULT_SOURCE_IP = \"source.ip\";\n        static final String DEFAULT_SOURCE_PORT = \"source.port\";\n        static final String DEFAULT_DEST_IP = \"destination.ip\";\n        static final String DEFAULT_DEST_PORT = \"destination.port\";\n        static final String DEFAULT_IANA_NUMBER = \"network.iana_number\";\n        static final String DEFAULT_TRANSPORT = \"network.transport\";\n        static final String DEFAULT_ICMP_TYPE = \"icmp.type\";\n        static final String DEFAULT_ICMP_CODE = \"icmp.code\";\n        static final String DEFAULT_TARGET = \"network.community_id\";\n\n        @Override\n        public CommunityIdProcessor create(\n            Map<String, Processor.Factory> registry,\n            String tag,","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java#L263-L299","documentation":"parseIntFromObjectOrString rejects objects that are not null, not a Number, and not a String parseable by Integer.parseInt. The field name ('source port', 'destination port', 'icmp type', 'icmp code') is interpolated, plus the offending object's toString. Thrown from buildFlow for the corresponding flow field.","triggerScenarios":"A port or ICMP type/code field that holds a non-numeric value such as a Boolean, a Map/List, or a String like 'abc' or '1.5' (Integer.parseInt rejects decimal notation). Only Integer values are accepted; Long/Float/Double are accepted because they are Number instances and intValue() is used.","commonSituations":"ECS field mapped as keyword but populated with 'tcp/443' (mixed); upstream enrichment that wrote a Boolean or object into a port field; CSV ingest with quoting artifacts; users assuming the parser accepts decimal port notation.","solutions":["Ensure the field is an Integer, Long, or a String containing only ASCII digits (with optional leading '+/-').","Strip any non-digit characters (e.g. 'tcp/443' -> '443') before community_id runs.","If the value is a decimal ('1.5'), convert to integer upstream or accept it cannot represent a port.","Quarantine failures via on_failure."],"exampleFix":"// before — non-numeric port string\n//   { \"source\": { \"port\": \"tcp/443\" } }\n//\n// after — bare integer string (or numeric type)\n//   { \"source\": { \"port\": \"443\" } }","handlingStrategy":"type-guard","validationCode":"boolean isParsableInt(Object o) {\n    if (o == null) return true;            // null is tolerated (resolves to 0)\n    if (o instanceof Number) return true;\n    if (o instanceof String s) return s.matches(\"[+-]?\\\\d+\");\n    return false;\n}","typeGuard":"static boolean isPortLike(Object o) {\n    return o == null || o instanceof Number\n        || (o instanceof String s && s.matches(\"[+-]?\\\\d+\"));\n}","tryCatchPattern":"{\n  \"community_id\": {\n    \"on_failure\": [\n      { \"set\": { \"field\": \"ingest.error\", \"value\": \"community-id-unparseable-int\" } },\n      { \"redirect\": { \"pipeline\": \"quarantine\" } }\n    ]\n  }\n}","preventionTips":["Keep port/ICMP fields as Integer/Long or as digit-only strings.","Strip protocol prefixes ('tcp/443' -> '443') upstream.","Remember the parser does not accept decimal notation ('1.5'); convert to int upstream."],"tags":["ingest","community-id","type-coercion","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}