{"record":{"id":"b0e82b2b1c1966f7","repo":"elastic/elasticsearch","slug":"provided-grok-expressions-do-not-match-field-value","errorCode":null,"errorMessage":"Provided Grok expressions do not match field value: [{}]","messagePattern":"Provided Grok expressions do not match field value: \\[(.+?)\\]","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/GrokProcessor.java","lineNumber":82,"sourceCode":"        this.validateOnly = validateOnly;\n        // Joni warnings are only emitted on an attempt to match, and the warning emitted for every call to match which is too verbose\n        // so here we emit a warning (if there is one) to the logfile at warn level on construction / processor creation.\n        new Grok(patternBank, combinedPattern, matcherWatchdog, logger::warn).match(\"___nomatch___\");\n    }\n\n    @Override\n    public IngestDocument execute(IngestDocument ingestDocument) throws Exception {\n        String fieldValue = ingestDocument.getFieldValue(matchField, String.class, ignoreMissing);\n\n        if (fieldValue == null && ignoreMissing) {\n            return ingestDocument;\n        } else if (fieldValue == null) {\n            throw new IllegalArgumentException(\"field [\" + matchField + \"] is null, cannot process it.\");\n        }\n\n        Map<String, Object> matches = grok.captures(fieldValue);\n        if (matches == null) {\n            throw new IllegalArgumentException(\"Provided Grok expressions do not match field value: [\" + fieldValue + \"]\");\n        }\n\n        if (!validateOnly) {\n            matches.forEach(ingestDocument::setFieldValue);\n        }\n\n        if (traceMatch) {\n            if (matchPatterns.size() > 1) {\n                @SuppressWarnings(\"unchecked\")\n                HashMap<String, String> matchMap = (HashMap<String, String>) ingestDocument.getFieldValue(PATTERN_MATCH_KEY, Object.class);\n                matchMap.keySet().stream().findFirst().ifPresent((index) -> { ingestDocument.setFieldValue(PATTERN_MATCH_KEY, index); });\n            } else {\n                ingestDocument.setFieldValue(PATTERN_MATCH_KEY, \"0\");\n            }\n        }\n        return ingestDocument;\n    }\n","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/GrokProcessor.java#L64-L100","documentation":"Thrown by GrokProcessor.execute when grok.captures(fieldValue) returns null, meaning none of the configured grok patterns matched the input string. This is a data/pattern mismatch — the value is non-null but no pattern captures it. IllegalArgumentException so the document fails the processor and can route to the failure pipeline.","triggerScenarios":"A document's match field contains a string that does not conform to any of the configured patterns. E.g. pattern expects Apache log format but the value is JSON.","commonSituations":"Log format drift, multiple log sources feeding one pipeline, overly strict patterns, or wrong pattern selection. Common when onboarding a new log source without updating patterns.","solutions":["Add additional patterns that cover the unmatched log variant, or loosen existing patterns.","Use trace_match to identify which pattern (if any) is firing and debug non-matches.","Route non-matching documents to a different pipeline or to the failure store for separate handling.","Verify the pattern syntax against Grok debugger / Kibana Grok Debugger tool."],"exampleFix":"// before\n{\"grok\": {\"field\": \"message\", \"patterns\": [\"%{COMBINEDAPACHELOG}\"]}}\n// after\n{\"grok\": {\"field\": \"message\", \"patterns\": [\"%{COMBINEDAPACHELOG}\", \"%{JSONLOG}\"], \"trace_match\": true}}","handlingStrategy":"try-catch","validationCode":"// Pre-test grok patterns against the value\nMap<String,Object> test = grok.captures(sampleValue);\nif (test == null) {\n    // pattern doesn't match — broaden or route differently\n}","typeGuard":null,"tryCatchPattern":"try {\n    grokProcessor.execute(doc);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"do not match field value\")) {\n        // route non-matching doc to alternate pipeline or failure store\n    } else throw e;\n}","preventionTips":["Maintain a library of representative sample logs and assert all patterns match them in tests.","Use trace_match to debug which patterns fire and which don't.","Plan for log format drift: add fallback patterns or route unmatched docs to a review pipeline."],"tags":["ingest","grok","pattern-mismatch","data"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}