{"record":{"id":"bad38e4729cde20c","repo":"elastic/elasticsearch","slug":"invalid-destination-port","errorCode":null,"errorMessage":"invalid destination port [{}]","messagePattern":"invalid destination port \\[(.+?)\\]","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java","lineNumber":237,"sourceCode":"\n        Object protocol = ianaNumber;\n        if (protocol == null) {\n            protocol = transport.get();\n            if (protocol == null) {\n                return null;\n            }\n        }\n        flow.protocol = Transport.fromObject(protocol);\n\n        switch (flow.protocol.getType()) {\n            case Tcp, Udp, Sctp -> {\n                flow.sourcePort = parseIntFromObjectOrString(sourcePort.get(), \"source port\");\n                if (flow.sourcePort < 1 || flow.sourcePort > 65535) {\n                    throw new IllegalArgumentException(\"invalid source port [\" + sourcePort.get() + \"]\");\n                }\n                flow.destinationPort = parseIntFromObjectOrString(destinationPort.get(), \"destination port\");\n                if (flow.destinationPort < 1 || flow.destinationPort > 65535) {\n                    throw new IllegalArgumentException(\"invalid destination port [\" + destinationPort.get() + \"]\");\n                }\n            }\n            case Icmp, IcmpIpV6 -> {\n                // tolerate missing or invalid ICMP types and codes\n                flow.icmpType = parseIntFromObjectOrString(icmpType, \"icmp type\");\n                flow.icmpCode = parseIntFromObjectOrString(icmpCode, \"icmp code\");\n            }\n        }\n\n        return flow;\n    }\n\n    @Override\n    public String getType() {\n        return TYPE;\n    }\n\n    /**","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java#L219-L255","documentation":"Destination-port twin of error 1110: for Tcp/Udp/Sctp flows, the parsed destination port must be 1..65535. A null destinationPort resolves to 0 and throws. destinationPort.get() is interpolated into the message.","triggerScenarios":"destination.port is 0, > 65535, negative, or absent (parses to 0) while transport is TCP/UDP/SCTP.","commonSituations":"Same as 1110 but on the destination side: unidirectional sensors, ICMP events mistakenly tagged as UDP, mis-typed port fields.","solutions":["Ensure destination.port is an integer in [1,65535] for TCP/UDP/SCTP flows.","Use ICMP/IcmpIpV6 transport when ports are not meaningful for the flow.","Pre-populate the field correctly upstream or drop such documents before community_id.","Use on_failure to quarantine."],"exampleFix":"// before — destination.port is 0\n//   { \"destination\": { \"ip\": \"10.0.0.2\", \"port\": 0 }, \"network\": { \"transport\": \"tcp\" } }\n//\n// after — destination.port in range\n//   { \"destination\": { \"ip\": \"10.0.0.2\", \"port\": 443 }, \"network\": { \"transport\": \"tcp\" } }","handlingStrategy":"validation","validationCode":"boolean isValidPort(Object o) {\n    if (o instanceof Number n) { int p = n.intValue(); return p >= 1 && p <= 65535; }\n    if (o instanceof String s && s.matches(\"-?\\\\d+\")) {\n        int p = Integer.parseInt(s); return p >= 1 && p <= 65535;\n    }\n    return false;\n}","typeGuard":null,"tryCatchPattern":"{\n  \"community_id\": {\n    \"on_failure\": [\n      { \"set\": { \"field\": \"ingest.error\", \"value\": \"community-id-bad-destination-port\" } },\n      { \"redirect\": { \"pipeline\": \"quarantine\" } }\n    ]\n  }\n}","preventionTips":["Same range contract as source port — destination.port must be in [1,65535].","Audit sensors that emit port 0 for 'unknown' and either backfill or drop those events.","Run a port-range pre-check before community_id in strict pipelines."],"tags":["ingest","community-id","port","validation"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}