{"record":{"id":"cab320c56a3b4be0","repo":"elastic/elasticsearch","slug":"field-is-null-cannot-extract-geoip-informati","errorCode":null,"errorMessage":"field [{}] is null, cannot extract geoip information.","messagePattern":"field \\[(.+?)\\] is null, cannot extract geoip information\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-ip-location/src/main/java/org/elasticsearch/ingest/iplocation/GeoIpProcessor.java","lineNumber":101,"sourceCode":"        this.firstOnly = firstOnly;\n        this.databaseFile = databaseFile;\n    }\n\n    boolean isIgnoreMissing() {\n        return ignoreMissing;\n    }\n\n    @Override\n    public IngestDocument execute(IngestDocument document) throws IOException {\n        Object ip = document.getFieldValue(field, Object.class, ignoreMissing);\n\n        if (ipDataLookup.isValid() == false) {\n            document.appendFieldValue(\"tags\", \"_\" + type + \"_expired_database\", false);\n            return document;\n        } else if (ip == null && ignoreMissing) {\n            return document;\n        } else if (ip == null) {\n            throw new IllegalArgumentException(\"field [\" + field + \"] is null, cannot extract geoip information.\");\n        }\n\n        if (ip instanceof String ipString) {\n            Map<String, Object> data = ipDataLookup.lookup(ipString);\n            if (data == null) {\n                if (ignoreMissing == false) {\n                    tag(document, type, databaseFile);\n                }\n                return document;\n            }\n            if (data.isEmpty() == false) {\n                writeGeoIpData(document, targetField, data);\n            }\n        } else if (ip instanceof List<?> ipList) {\n            boolean match = false;\n            List<Map<String, Object>> dataList = new ArrayList<>(ipList.size());\n            for (Object ipAddr : ipList) {\n                if (ipAddr instanceof String == false) {","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-ip-location/src/main/java/org/elasticsearch/ingest/iplocation/GeoIpProcessor.java#L83-L119","documentation":"Thrown by GeoIpProcessor.execute when the source field resolves to null and ignore_missing is false. The processor needs at least one IP value to perform the lookup; null is rejected unless the processor is configured to tolerate missing fields.","triggerScenarios":"Running the geoip processor on a document where the IP source field is absent or null, with ignore_missing omitted or set to false.","commonSituations":"Logs where the client IP is sometimes unavailable. Events from internal sources that strip IP fields. Fields populated by upstream processors that occasionally fail.","solutions":["Set ignore_missing: true in the geoip processor config.","Use an 'if' condition to skip the processor when the IP field is absent.","Ensure upstream enrichment populates the IP field reliably."],"exampleFix":"// before\n{\n  \"geoip\": { \"field\": \"client_ip\", \"target_field\": \"geo\" }\n}\n// after\n{\n  \"geoip\": { \"field\": \"client_ip\", \"target_field\": \"geo\", \"ignore_missing\": true }\n}","handlingStrategy":"validation","validationCode":"// Set ignore_missing: true on geoip, or pre-check\nObject val = document.getFieldValue(\"client_ip\", Object.class, true);\nif (val == null) {\n    // skip geoip; or configure ignore_missing: true\n}","typeGuard":"boolean hasIpValue(IngestDocument doc, String field) {\n    Object v = doc.getFieldValue(field, Object.class, true);\n    return v instanceof String || v instanceof List;\n}","tryCatchPattern":"try {\n    // run geoip processor\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"is null, cannot extract geoip\")) {\n        // enable ignore_missing: true or add a guard\n    } else { throw e; }\n}","preventionTips":["Set ignore_missing: true for optional IP fields.","Add an 'if' condition to skip the processor when the field is null.","Ensure upstream enrichment reliably populates IP fields."],"tags":["elasticsearch","ingest-pipeline","geoip","validation","null-handling"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}