{"record":{"id":"5974a0d3ec5e7655","repo":"elastic/elasticsearch","slug":"invalid-ip-address-format","errorCode":null,"errorMessage":"Invalid IP address format","messagePattern":"Invalid IP address format","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java","lineNumber":576,"sourceCode":"\n    // visible for testing\n    String toMACAddress(String v) throws IllegalArgumentException {\n        // Insert separators if necessary\n        String macWithSeparators = insertMACSeparators(v);\n        // Validate MAC address format\n        Matcher matcher = MAC_ADDRESS_PATTERN.matcher(macWithSeparators);\n        if (matcher.matches() == false) {\n            throw new IllegalArgumentException(\"Invalid MAC address format\");\n        }\n        return macWithSeparators;\n    }\n\n    // visible for testing\n    String toIP(String v) {\n        try {\n            return NetworkAddress.format(InetAddresses.forString(v));\n        } catch (IllegalArgumentException e) {\n            throw new IllegalArgumentException(\"Invalid IP address format\", e);\n        }\n    }\n\n    private static String insertMACSeparators(String v) {\n        // Check that the length is correct for a MAC address without separators.\n        // And check that there isn't already a separator in the string.\n        if ((v.length() != EUI48_HEX_LENGTH && v.length() != EUI64_HEX_LENGTH)\n            || v.charAt(2) == ':'\n            || v.charAt(2) == '-'\n            || v.charAt(4) == '.') {\n            return v;\n        }\n        StringBuilder sb = new StringBuilder(EUI64_HEX_WITH_SEPARATOR_MAX_LENGTH);\n        for (int i = 0; i < v.length(); i++) {\n            sb.append(v.charAt(i));\n            if (i < v.length() - 1 && i % 2 != 0) {\n                sb.append(':');\n            }","sourceCodeStart":558,"sourceCodeEnd":594,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java#L558-L594","documentation":"CefParser.toIP delegates to InetAddresses.forString and re-wraps any IllegalArgumentException it throws, attaching the original as cause. Applies to CEF extensions mapped to DataType.IPType (src, dst, shost, dhost, agt, etc.). Both IPv4 and IPv2 textual forms are accepted by the underlying parser.","triggerScenarios":"An IP-typed extension value that is not a valid IPv4 or IPv6 literal: '192.168.1.999', 'not-an-ip', 'fe80::1%eth0' (zone id not supported by Guava's InetAddresses.forString), or a hostname mistakenly placed in the field.","commonSituations":"Producer writes a hostname or domain into an IP field; address has a scope/zone suffix; leading/trailing whitespace survived sanitization; malformed octet from a buggy packet decoder.","solutions":["Ensure the source field contains only a literal IPv4 or IPv6 address (no hostnames, no CIDR prefixes, no zone identifiers).","Pre-resolve or pre-strip hostnames/scope IDs before the cef processor using a script.","Use on_failure to quarantine events with unparseable addresses.","If the value is a CIDR, extract the host portion first."],"exampleFix":"// before — value is not a bare IP literal\n//   field: 'CEF:0|v|p|1.0|1|n|3|src=host.example.com next=...'\n//\n// after — value is a literal IPv4/IPv6 address\n//   field: 'CEF:0|v|p|1.0|1|n|3|src=192.168.1.10 next=...'","handlingStrategy":"validation","validationCode":"// Use the same library the parser uses.\nimport com.google.common.net.InetAddresses;\nboolean isParsableIp(String v) {\n    if (v == null) return false;\n    try { InetAddresses.forString(v); return true; }\n    catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"{\n  \"on_failure\": [\n    { \"set\": { \"field\": \"ingest.error\", \"value\": \"cef-bad-ip\" } },\n    { \"redirect\": { \"pipeline\": \"quarantine\" } }\n  ]\n}","preventionTips":["Reject hostnames, CIDR blocks, and zone-scoped IPv6 literals in IP-typed CEF fields.","Strip leading/trailing whitespace from IP values upstream.","Use the same InetAddresses helper in any pre-validation you write, so semantics match."],"tags":["ingest","cef","ip-address","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}