{"record":{"id":"a7f7cee53b8c5515","repo":"elastic/elasticsearch","slug":"unsupported-ecs-compatibility-mode","errorCode":null,"errorMessage":"unsupported ECS compatibility mode [{}]","messagePattern":"unsupported ECS compatibility mode \\[(.+?)\\]","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"libs/grok/src/main/java/org/elasticsearch/grok/GrokBuiltinPatterns.java","lineNumber":62,"sourceCode":"    public static synchronized PatternBank get(boolean ecsCompatibility) {\n        if (ecsCompatibility) {\n            if (ECS_V1_PATTERNS == null) {\n                ECS_V1_PATTERNS = loadEcsPatterns();\n            }\n            return ECS_V1_PATTERNS;\n        } else {\n            if (LEGACY_PATTERNS == null) {\n                LEGACY_PATTERNS = loadLegacyPatterns();\n            }\n            return LEGACY_PATTERNS;\n        }\n    }\n\n    public static PatternBank get(String ecsCompatibility) {\n        if (isValidEcsCompatibilityMode(ecsCompatibility)) {\n            return get(ECS_COMPATIBILITY_V1.equals(ecsCompatibility));\n        } else {\n            throw new IllegalArgumentException(\"unsupported ECS compatibility mode [\" + ecsCompatibility + \"]\");\n        }\n    }\n\n    public static boolean isValidEcsCompatibilityMode(String ecsCompatibility) {\n        return ECS_COMPATIBILITY_MODES.contains(ecsCompatibility);\n    }\n\n    private static PatternBank loadLegacyPatterns() {\n        var patternNames = List.of(\n            \"aws\",\n            \"bacula\",\n            \"bind\",\n            \"bro\",\n            \"exim\",\n            \"firewalls\",\n            \"grok-patterns\",\n            \"haproxy\",\n            \"httpd\",","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/grok/src/main/java/org/elasticsearch/grok/GrokBuiltinPatterns.java#L44-L80","documentation":"Thrown by GrokBuiltinPatterns.get(String ecsCompatibility) when the provided ECS compatibility mode string is not one of the valid modes. Valid modes are defined in ECS_COMPATIBILITY_MODES: \"disabled\" (legacy patterns) and \"v1\" (ECS v1 patterns). The get(String) overload validates the input and delegates to get(boolean) for actual loading.","triggerScenarios":"Calling GrokBuiltinPatterns.get(ecsCompatibility) with a string other than \"disabled\" or \"v1\". This typically occurs in Elasticsearch ingest processor configuration where the ECS compatibility setting is user-provided. Passing null, \"off\", \"true\", \"legacy\", or any other value triggers this error.","commonSituations":"Elasticsearch grok ingest processor configured with an invalid ecs_compatibility setting; pipeline migration from Logstash where different ECS mode names are used; typo in configuration (e.g. \"v2\", \"ecs\", \"yes\"); passing null when the caller expects a default.","solutions":["Use one of the valid ECS compatibility modes: \"disabled\" or \"v1\".","If unsure, use GrokBuiltinPatterns.get(false) (boolean overload) for legacy patterns or GrokBuiltinPatterns.get(true) for ECS v1.","Validate the ecs_compatibility setting in the ingest pipeline configuration before passing it to GrokBuiltinPatterns.get().","Use GrokBuiltinPatterns.isValidEcsCompatibilityMode(value) to check before calling get()."],"exampleFix":"// before — invalid ECS mode\nPatternBank bank = GrokBuiltinPatterns.get(\"v2\");\n\n// after — valid ECS mode\nPatternBank bank = GrokBuiltinPatterns.get(\"v1\");\n// or validate first\nString mode = GrokBuiltinPatterns.isValidEcsCompatibilityMode(config) ? config : \"disabled\";\nPatternBank bank = GrokBuiltinPatterns.get(mode);","handlingStrategy":"validation","validationCode":"if (!GrokBuiltinPatterns.isValidEcsCompatibilityMode(ecsCompatibility)) {\n    throw new IllegalArgumentException(\n        \"Invalid ECS compatibility mode: \" + ecsCompatibility + \". Valid modes: \" + GrokBuiltinPatterns.ECS_COMPATIBILITY_MODES);\n}\nPatternBank bank = GrokBuiltinPatterns.get(ecsCompatibility);","typeGuard":"static boolean isValidEcsMode(String mode) {\n    return GrokBuiltinPatterns.ECS_COMPATIBILITY_MODES.contains(mode);\n}","tryCatchPattern":null,"preventionTips":["Always validate ecsCompatibility against GrokBuiltinPatterns.isValidEcsCompatibilityMode() before calling get().","Use the boolean overload GrokBuiltinPatterns.get(true/false) to avoid string validation entirely.","Document the valid values (\"disabled\", \"v1\") in configuration schemas."],"tags":["grok","pattern-matching","validation","configuration","ecs","ingest"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}