{"record":{"id":"887e62a7537ca248","repo":"elastic/elasticsearch","slug":"invalid-extensions-in-the-cef-event","errorCode":null,"errorMessage":"Invalid extensions in the CEF event: {}","messagePattern":"Invalid extensions in the CEF event: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java","lineNumber":411,"sourceCode":"                } else {\n                    throw new IllegalArgumentException(\"Illegal escape sequence '\\\\\" + next + \"'\"); // TODO gross on \\n, for example ugh\n                }\n                i++; // and skip the next character\n            } else if (curr == '=') { // an equals, it's the end of a chunk\n                chunks.add(buffer.toString()); // emit the chunk\n                buffer = new StringBuilder(); // and reset the buffer\n            } else { // any other character\n                buffer.append(curr); // is just added to the current thing\n            }\n        }\n        chunks.add(buffer.toString()); // don't forget the ragged-edge last chunk ;)\n\n        if (chunks.size() == 1) {\n            String chunk = chunks.getFirst();\n            if (chunk.isEmpty()) {\n                return Map.of();\n            } else {\n                throw new IllegalArgumentException(\"Invalid extensions in the CEF event: \" + chunk);\n            }\n        }\n\n        // now turn chunks into pairs by splitting on the last space character\n        // given 'foo', 'bar\\bar = bar baz ', 'quux ', we want to end up with { 'foo': 'bar\\bar = bar ', 'baz': 'quux'}\n        Map<String, String> extensions = HashMap.newHashMap(chunks.size() - 1);\n        String key, value, chunk;\n        key = chunks.getFirst();\n        if (key.isEmpty() || containsWhitespace(key)) {\n            throw new IllegalArgumentException(UNESCAPED_EQUALS_SIGN); // TODO I'm not sure this error message is actually fair anymore\n        }\n        for (int j = 1; j < chunks.size() - 1; j++) {\n            chunk = chunks.get(j);\n            int idx = chunk.lastIndexOf(' ');\n            if (idx == -1) {\n                value = \"\";\n            } else {\n                value = chunk.substring(0, idx);","sourceCodeStart":393,"sourceCodeEnd":429,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java#L393-L429","documentation":"Thrown by CefParser.parseExtensions when splitting the extension string on '=' produced exactly one chunk that is non-empty. Because every CEF extension is a key=value pair, a single non-empty chunk means no '=' separator was found at all, so the input cannot be turned into a key/value map. The empty case returns Map.of() instead of throwing.","triggerScenarios":"Calling CefProcessor on a CEF event whose extension section is a single bare token with no '=' — e.g. 'CEF:0|v|p|1.0|1|n|3|justtext' (extension segment is 'justtext'), or a truncated/malformed line where the trailing key=value pairs were stripped.","commonSituations":"Producer truncates the message before emitting any extension pair; a log shipper splits the CEF line on a delimiter and drops the tail; the test fixture omits the extension block; an upstream grok pattern captured only the header into the cef field.","solutions":["Verify the full CEF line is reaching the processor intact — inspect the raw field value in _source.","Route failing documents to an on_failure pipeline and log the offending value for producer-side correction.","Pre-validate that the field contains at least one '=' after the CEF header before sending it to the cef processor.","If the field is legitimately empty for some events, leave it empty (an empty extension string returns an empty map, no throw)."],"exampleFix":"// before — no '=' in the extension segment\n//   field: 'CEF:0|v|p|1.0|1|n|3|lonelytoken'\n//\n// after — ensure the extension section contains at least one key=value pair\n//   field: 'CEF:0|v|p|1.0|1|n|3|act=lonelytoken'","handlingStrategy":"validation","validationCode":"// A well-formed CEF extension section contains at least one '='.\nboolean hasKeyValueSeparator(String ext) {\n    return ext != null && !ext.isBlank() && ext.indexOf('=') >= 0;\n}","typeGuard":null,"tryCatchPattern":"{\n  \"on_failure\": [\n    { \"set\": { \"field\": \"ingest.error\", \"value\": \"cef-no-extension-separator\" } },\n    { \"redirect\": { \"pipeline\": \"quarantine\" } }\n  ]\n}","preventionTips":["Validate CEF extension blocks contain at least one '=' before they reach the cef processor.","Make producers emit 'key=value' pairs only; reject free-text payloads in the extension block.","Quarantine malformed events rather than failing the bulk request."],"tags":["ingest","cef","malformed-input","parsing"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}