{"record":{"id":"b80e65abf35f514c","repo":"elastic/elasticsearch","slug":"invalid-mac-address-format","errorCode":null,"errorMessage":"Invalid MAC address format","messagePattern":"Invalid MAC address format","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java","lineNumber":566,"sourceCode":"                        newTime = newTime.with(field, accessor.get(field));\n                    }\n                }\n                accessor = newTime.withZoneSameLocal(timezone);\n            }\n            return DateFormatters.from(accessor, Locale.ROOT, timezone).withZoneSameInstant(timezone);\n        } catch (DateTimeParseException ignored) {\n            throw new IllegalArgumentException(\"Value is not a valid timestamp: \" + value);\n        }\n    }\n\n    // visible for testing\n    String toMACAddress(String v) throws IllegalArgumentException {\n        // Insert separators if necessary\n        String macWithSeparators = insertMACSeparators(v);\n        // Validate MAC address format\n        Matcher matcher = MAC_ADDRESS_PATTERN.matcher(macWithSeparators);\n        if (matcher.matches() == false) {\n            throw new IllegalArgumentException(\"Invalid MAC address format\");\n        }\n        return macWithSeparators;\n    }\n\n    // visible for testing\n    String toIP(String v) {\n        try {\n            return NetworkAddress.format(InetAddresses.forString(v));\n        } catch (IllegalArgumentException e) {\n            throw new IllegalArgumentException(\"Invalid IP address format\", e);\n        }\n    }\n\n    private static String insertMACSeparators(String v) {\n        // Check that the length is correct for a MAC address without separators.\n        // And check that there isn't already a separator in the string.\n        if ((v.length() != EUI48_HEX_LENGTH && v.length() != EUI64_HEX_LENGTH)\n            || v.charAt(2) == ':'","sourceCodeStart":548,"sourceCodeEnd":584,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java#L548-L584","documentation":"CefParser.toMACAddress inserts ':' separators into a bare hex string (if length is 12 or 16) and then matches MAC_ADDRESS_PATTERN. If the matcher does not match, the value is rejected. Applies to any CEF extension mapped to DataType.MACAddressType (smac, dmac, amac, etc.). No exception cause is attached.","triggerScenarios":"A MAC-typed extension value such as '00:11:22:33:44', 'ZZ:ZZ:ZZ:ZZ:ZZ:ZZ', 'aa-bb-cc-dd-ee', or 'not-a-mac'. Both the EUI-48 and EUI-64 forms (colon/hyphen/dot separated, or 12/16 hex chars unseparated) are accepted; anything else throws.","commonSituations":"Producer emits a partial or placeholder MAC ('00:00:00:00:00:00' is valid and does NOT throw, but 'unknown' or a stripped value does); a normalization step upstream trims characters; IPv6 address mistakenly mapped to a MAC field.","solutions":["Verify the source field actually contains a MAC in one of the four supported formats.","Add a grok/regex pre-processor to normalize MAC values into colon-separated form.","Route failures to an on_failure pipeline.","If the value is sometimes absent rather than malformed, set ignore_empty_values on the cef processor to drop empty-string entries."],"exampleFix":"// before — partial / malformed MAC\n//   field: 'CEF:0|v|p|1.0|1|n|3|smac=0011223344 next=...'\n//\n// after — full 6-byte MAC in any supported layout\n//   field: 'CEF:0|v|p|1.0|1|n|3|smac=00:11:22:33:44:55 next=...'","handlingStrategy":"validation","validationCode":"// Mirror CefParser's accepted MAC shapes: colon/hyphen/dot separated EUI-48 or EUI-64, or 12/16 hex chars.\nprivate static final Pattern MAC = Pattern.compile(\n    \"(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}|\" +\n    \"(?:[0-9A-Fa-f]{4}\\\\.){2}[0-9A-Fa-f]{4}|\" +\n    \"(?:[0-9A-Fa-f]{2}[:-]){7}[0-9A-Fa-f]{2}|\" +\n    \"(?:[0-9A-Fa-f]{4}\\\\.){3}[0-9A-Fa-f]{4}|\" +\n    \"[0-9A-Fa-f]{12}|[0-9A-Fa-f]{16}\");\nboolean isLikelyMac(String v) { return v != null && MAC.matcher(v).matches(); }","typeGuard":null,"tryCatchPattern":"{\n  \"on_failure\": [\n    { \"set\": { \"field\": \"ingest.error\", \"value\": \"cef-bad-mac\" } },\n    { \"redirect\": { \"pipeline\": \"quarantine\" } }\n  ]\n}","preventionTips":["Normalize MAC values to colon-separated EUI-48 form upstream.","Replace placeholder values ('unknown', 'none') with an empty string and rely on ignore_empty_values.","Run a regex pre-check on MAC-typed fields before the cef processor."],"tags":["ingest","cef","mac-address","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}