{"record":{"id":"57bee0d9f947e62c","repo":"elastic/elasticsearch","slug":"value-is-not-a-valid-timestamp","errorCode":null,"errorMessage":"Value is not a valid timestamp: {}","messagePattern":"Value is not a valid timestamp: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java","lineNumber":555,"sourceCode":"            // if there is no year nor year-of-era, we fall back to the current one and\n            // fill the rest of the date up with the parsed date\n            if (accessor.isSupported(ChronoField.YEAR) == false\n                && accessor.isSupported(ChronoField.YEAR_OF_ERA) == false\n                && accessor.isSupported(WeekFields.ISO.weekBasedYear()) == false\n                && accessor.isSupported(WeekFields.of(Locale.ROOT).weekBasedYear()) == false\n                && accessor.isSupported(ChronoField.INSTANT_SECONDS) == false) {\n                int year = LocalDate.now(ZoneOffset.UTC).getYear();\n                ZonedDateTime newTime = Instant.EPOCH.atZone(ZoneOffset.UTC).withYear(year);\n                for (ChronoField field : CHRONO_FIELDS) {\n                    if (accessor.isSupported(field)) {\n                        newTime = newTime.with(field, accessor.get(field));\n                    }\n                }\n                accessor = newTime.withZoneSameLocal(timezone);\n            }\n            return DateFormatters.from(accessor, Locale.ROOT, timezone).withZoneSameInstant(timezone);\n        } catch (DateTimeParseException ignored) {\n            throw new IllegalArgumentException(\"Value is not a valid timestamp: \" + value);\n        }\n    }\n\n    // visible for testing\n    String toMACAddress(String v) throws IllegalArgumentException {\n        // Insert separators if necessary\n        String macWithSeparators = insertMACSeparators(v);\n        // Validate MAC address format\n        Matcher matcher = MAC_ADDRESS_PATTERN.matcher(macWithSeparators);\n        if (matcher.matches() == false) {\n            throw new IllegalArgumentException(\"Invalid MAC address format\");\n        }\n        return macWithSeparators;\n    }\n\n    // visible for testing\n    String toIP(String v) {\n        try {","sourceCodeStart":537,"sourceCodeEnd":573,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java#L537-L573","documentation":"CefParser.toTimestamp could not interpret the value either as epoch milliseconds (pure digits) or via the configured TIME_FORMAT DateTimeFormatter. Thrown as IllegalArgumentException when a CEF extension mapped to DataType.TimestampType (e.g. 'rt', 'end', 'start', 'art') has a value matching neither shape. The original DateTimeParseException is swallowed.","triggerScenarios":"Calling CefProcessor on an event whose timestamp-typed extension carries a value like '2024/06/01 12:00:00', 'Jun 1 2024', 'today', or any locale/format that does not match the strict TIME_FORMAT. An epoch value in seconds (not ms) — e.g. '1717200000' — is parsed as ms and silently shifted but does NOT throw; only a fully unparseable value throws.","commonSituations":"Producer changes date format without notice; non-English locale month names; AM/PM markers missing; sub-second precision with an unexpected separator; test fixtures with hand-typed dates.","solutions":["Confirm the producer's exact timestamp format and align it with the TIME_FORMAT expected by the parser (MMddyyyy HH:mm:ss.SSS or epoch ms).","If the value is epoch-seconds, multiply by 1000 upstream so the parser sees milliseconds.","Pre-format the timestamp with a date processor set to the producer's format before routing to cef, or override the field to StringType so no parse is attempted.","Use on_failure to quarantine events with unparseable timestamps."],"exampleFix":"// before — value uses a format the parser does not recognize\n//   field: 'CEF:0|v|p|1.0|1|n|3|rt=2024-06-01T12:00:00Z next=...'\n//\n// after — emit epoch ms or the parser's expected layout\n//   field: 'CEF:0|v|p|1.0|1|n|3|rt=Jun 01 2024 12:00:00.000 next=...'\n//   or:   '...|rt=1717233600000 next=...'","handlingStrategy":"validation","validationCode":"// Accept epoch-ms (digits only) or the strict CEF timestamp layout; reject everything else early.\nprivate static final Pattern CEF_TS = Pattern.compile(\"^\\\\d+$|\" +\n    \"^[A-Z][a-z]{2} \\\\d{2} \\\\d{4} \\\\d{2}:\\\\d{2}:\\\\d{2}(\\\\.\\\\d{3})?$\");\nboolean isAcceptableTimestamp(String v) {\n    return v != null && CEF_TS.matcher(v).matches();\n}","typeGuard":null,"tryCatchPattern":"{\n  \"on_failure\": [\n    { \"set\": { \"field\": \"ingest.error\", \"value\": \"cef-bad-timestamp\" } },\n    { \"redirect\": { \"pipeline\": \"quarantine\" } }\n  ]\n}","preventionTips":["Confirm the producer's timestamp format matches TIME_FORMAT or epoch-ms before enabling the cef processor.","If you cannot change the producer, use a date processor upstream to normalize the value first.","For epoch-seconds, multiply by 1000 before the cef processor sees the value."],"tags":["ingest","cef","timestamp","date-format","parsing"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T11:17:21.771Z"}