{"record":{"id":"c80064b534ddf4d9","repo":"elastic/elasticsearch","slug":"unable-to-calculate-network-direction-from-documen","errorCode":null,"errorMessage":"unable to calculate network direction from document","messagePattern":"unable to calculate network direction from document","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/NetworkDirectionProcessor.java","lineNumber":89,"sourceCode":"        return internalNetworks;\n    }\n\n    public String getInternalNetworksField() {\n        return internalNetworksField;\n    }\n\n    public boolean getIgnoreMissing() {\n        return ignoreMissing;\n    }\n\n    @Override\n    public IngestDocument execute(IngestDocument ingestDocument) throws Exception {\n        String direction = getDirection(ingestDocument);\n        if (direction == null) {\n            if (ignoreMissing) {\n                return ingestDocument;\n            } else {\n                throw new IllegalArgumentException(\"unable to calculate network direction from document\");\n            }\n        }\n\n        ingestDocument.setFieldValue(targetField, direction);\n        return ingestDocument;\n    }\n\n    private String getDirection(IngestDocument d) throws Exception {\n        List<String> networks = new ArrayList<>();\n\n        if (internalNetworksField != null) {\n            @SuppressWarnings(\"unchecked\")\n            List<String> stringList = d.getFieldValue(internalNetworksField, networks.getClass(), ignoreMissing);\n            if (stringList == null) {\n                return null;\n            }\n            networks.addAll(stringList);\n        } else {","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/NetworkDirectionProcessor.java#L71-L107","documentation":"Thrown by NetworkDirectionProcessor.execute when getDirection(ingestDocument) returns null — meaning the processor could not determine a network direction from the available fields. The processor requires source/destination IP and configured network lists; if any required input is missing or none of the configured networks match, direction stays null. IllegalArgumentException when ignoreMissing=false; otherwise the document passes through unchanged.","triggerScenarios":"Document lacks required source/destination IP fields, or internal/external network lists are empty/misconfigured, so no direction can be computed.","commonSituations":"Source data missing IP fields (e.g. non-network log), categories field absent, internal_networks not configured, or destination IP field path wrong.","solutions":["Set \"ignore_missing\": true to pass through documents that can't be classified.","Ensure source_ip/destination_ip/internal_networks/categories fields are populated upstream.","Verify the internal_networks / external_networks chain includes the relevant CIDR ranges.","Gate the processor with a conditional that checks required fields exist."],"exampleFix":"// before\n{\"network_direction\": {\"source_ip\": \"src\", \"destination_ip\": \"dst\"}}\n// after\n{\"network_direction\": {\"source_ip\": \"src\", \"destination_ip\": \"dst\", \"ignore_missing\": true}}","handlingStrategy":"validation","validationCode":"// Pre-check required IP fields exist before invoking processor\nif (!doc.hasField(sourceIp) || !doc.hasField(destIp)) {\n    if (!ignoreMissing) {\n        // set ignore_missing or skip document\n    }\n}","typeGuard":"static boolean canComputeDirection(IngestDocument doc, String src, String dst) {\n    return doc.hasField(src) && doc.hasField(dst);\n}","tryCatchPattern":"try {\n    ndProcessor.execute(doc);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"unable to calculate network direction\")) {\n        // route unclassifiable docs elsewhere\n    } else throw e;\n}","preventionTips":["Default ignore_missing=true for network_direction when documents vary in shape.","Ensure source/destination IP fields are populated upstream.","Verify internal/external network CIDR lists cover expected ranges."],"tags":["ingest","network-direction","configuration","missing-field"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}