{"record":{"id":"a368ab03b3cd56c9","repo":"elastic/elasticsearch","slug":"invalid-cef-format","errorCode":null,"errorMessage":"Invalid CEF format","messagePattern":"Invalid CEF format","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java","lineNumber":317,"sourceCode":"                buffer.append('\\\\'); // emit a backslash\n                i++; // and skip the next character\n            } else if (curr == '\\\\' && next == '|') { // an escaped pipe\n                buffer.append('|'); // emit a pipe\n                i++; // and skip the next character\n            } else if (curr == '|') { // a pipe, it's the end of a header\n                headers.add(buffer.toString()); // emit the header\n                buffer = new StringBuilder(); // and reset the buffer\n                if (headers.size() == 7) {\n                    extensionStart = i + 1; // the extensions begin after this pipe\n                    break; // we've processed all the headers, so exit the loop\n                }\n            } else { // any other character\n                buffer.append(curr); // is just added to the header\n            }\n        }\n\n        if (headers.isEmpty() || headers.getFirst().startsWith(\"CEF:\") == false) {\n            throw new IllegalArgumentException(INVALID_CEF_FORMAT);\n        }\n\n        if (headers.size() != 7) {\n            throw new IllegalArgumentException(INCOMPLETE_CEF_HEADER);\n        }\n\n        // for simplicity of the interface, pack the unparsed extension string itself into the returned list of headers\n        String extensionString = cefString.substring(extensionStart);\n        headers.add(extensionString);\n\n        return headers;\n    }\n\n    private static void processHeaders(List<String> headers, CefEvent event) {\n        for (int i = 0; i < headers.size(); i++) {\n            final String value = headers.get(i);\n            switch (i) {\n                case 0 -> event.addCefMapping(\"version\", value.substring(4));","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java#L299-L335","documentation":"IllegalArgumentException(INVALID_CEF_FORMAT) from parseHeaders when the parsed header list is empty or the first header does not start with 'CEF:'. CEF (Common Event Format) mandates a leading 'CEF:version|...' token; anything else is rejected before field-count validation.","triggerScenarios":"The Cef ingest processor receives a string that is empty, does not begin with 'CEF:', or whose first pipe-delimited token isn't a CEF version token. Line 316 check fails.","commonSituations":"Feeding raw syslog/JSON instead of CEF; truncated first field; LE EF (LEEF) format confused with CEF; encoding/prefix stripping by a shipper.","solutions":["Ensure the input string starts with a CEF version token, e.g. 'CEF:0|vendor|product|1.0|100|name|6|...'","Verify the upstream producer emits CEF and not another format","If using a multiline codec, collapse to a single CEF line before this processor"],"exampleFix":"// before: field document = \"vendor|product|1.0|...\"  // missing CEF:0 prefix\n// after\n\"CEF:0|Vendor|Product|1.0|100|Event Name|6|act=blocked dst=10.0.0.1\"","handlingStrategy":"validation","validationCode":"// Reject non-CEF input before the CEF processor:\nString first = input.isBlank() ? \"\" : input.substring(0, Math.min(input.length(),4));\nif (input.isBlank() || !input.startsWith(\"CEF:\")) {\n    throw new IllegalArgumentException(\"Invalid CEF format\");\n}","typeGuard":null,"tryCatchPattern":"try { cefProcessor.execute(doc); }\ncatch (IllegalArgumentException e) {\n    if (\"Invalid CEF format\".equals(e.getMessage())) { routeToNonCefPipeline(doc); }\n    else throw e;\n}","preventionTips":["Validate the 'CEF:' prefix at the producer/shipper before ingest","Use separate pipelines for CEF vs non-CEF event sources","Test sample events through the parser in a sandbox first"],"tags":["ingest","cef","parse-error","format"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}