{"record":{"id":"9d470b7f1b1a6067","repo":"elastic/elasticsearch","slug":"incomplete-cef-header","errorCode":null,"errorMessage":"Incomplete CEF header","messagePattern":"Incomplete CEF header","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java","lineNumber":321,"sourceCode":"                i++; // and skip the next character\n            } else if (curr == '|') { // a pipe, it's the end of a header\n                headers.add(buffer.toString()); // emit the header\n                buffer = new StringBuilder(); // and reset the buffer\n                if (headers.size() == 7) {\n                    extensionStart = i + 1; // the extensions begin after this pipe\n                    break; // we've processed all the headers, so exit the loop\n                }\n            } else { // any other character\n                buffer.append(curr); // is just added to the header\n            }\n        }\n\n        if (headers.isEmpty() || headers.getFirst().startsWith(\"CEF:\") == false) {\n            throw new IllegalArgumentException(INVALID_CEF_FORMAT);\n        }\n\n        if (headers.size() != 7) {\n            throw new IllegalArgumentException(INCOMPLETE_CEF_HEADER);\n        }\n\n        // for simplicity of the interface, pack the unparsed extension string itself into the returned list of headers\n        String extensionString = cefString.substring(extensionStart);\n        headers.add(extensionString);\n\n        return headers;\n    }\n\n    private static void processHeaders(List<String> headers, CefEvent event) {\n        for (int i = 0; i < headers.size(); i++) {\n            final String value = headers.get(i);\n            switch (i) {\n                case 0 -> event.addCefMapping(\"version\", value.substring(4));\n                case 1 -> {\n                    event.addCefMapping(\"device.vendor\", value);\n                    event.addRootMapping(\"observer.vendor\", value);\n                }","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java#L303-L339","documentation":"IllegalArgumentException(INCOMPLETE_CEF_HEADER) from parseHeaders after the CEF prefix is confirmed valid but the pipe-splitting did not yield exactly 7 header fields. CEF defines seven mandatory header fields (Version, DeviceVendor, DeviceProduct, DeviceVersion, SignatureID, Name, Severity); missing or extra pipes both fail.","triggerScenarios":"Input starts with 'CEF:' but contains fewer or more than 6 unescaped pipe separators before the extension block. Line 320 check (headers.size() != 7) fires.","commonSituations":"Producer omits an empty field (writes 'CEF:0|v|p||1.0|...' missing a pipe); unescaped pipe inside a field value; extra trailing pipe; version of producer with non-standard field count.","solutions":["Escape literal pipe characters in field values as '\\|' per CEF spec","Ensure all seven header fields are present, even if empty (emit empty fields as consecutive pipes)","Validate the header count on the producer side before sending"],"exampleFix":"// before: only 6 fields (missing severity) -> incomplete\n\"CEF:0|Vendor|Product|1.0|100|Name|\"\n// after: 7 fields with severity\n\"CEF:0|Vendor|Product|1.0|100|Name|6|ext=...\"","handlingStrategy":"validation","validationCode":"// Validate seven headers before relying on the CEF processor:\nlong pipes = input.chars().filter(c -> c == '|').count();\n// note: unescaped pipes only; do a proper escape-aware count in production\nif (pipes < 6) throw new IllegalArgumentException(\"Incomplete CEF header\");","typeGuard":null,"tryCatchPattern":"try { cefProcessor.execute(doc); }\ncatch (IllegalArgumentException e) {\n    if (\"Incomplete CEF header\".equals(e.getMessage())) { quarantine(doc); }\n    else throw e;\n}","preventionTips":["Ensure producers emit all seven header fields, using empty values where needed","Escape literal pipes in field values as '\\|'","Add a header-count assertion in event-format tests"],"tags":["ingest","cef","parse-error","header-count"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}