{"record":{"id":"f2ca76d962768f92","repo":"elastic/elasticsearch","slug":"field-does-not-contain-value-split","errorCode":null,"errorMessage":"field [{}] does not contain value_split [{}]","messagePattern":"field \\[(.+?)\\] does not contain value_split \\[(.+?)\\]","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/KeyValueProcessor.java","lineNumber":160,"sourceCode":"            String path = document.renderTemplate(field);\n            if (path.isEmpty() || document.hasField(path, true) == false) {\n                if (ignoreMissing) {\n                    return;\n                } else {\n                    throw new IllegalArgumentException(\"field [\" + path + \"] doesn't exist\");\n                }\n            }\n            String value = document.getFieldValue(path, String.class, ignoreMissing);\n            if (value == null) {\n                if (ignoreMissing) {\n                    return;\n                }\n                throw new IllegalArgumentException(\"field [\" + path + \"] is null, cannot extract key-value pairs.\");\n            }\n            for (String part : fieldSplitter.apply(value)) {\n                String[] kv = valueSplitter.apply(part);\n                if (kv.length != 2) {\n                    throw new IllegalArgumentException(\"field [\" + path + \"] does not contain value_split [\" + valueSplit + \"]\");\n                }\n                String key = keyTrimmer.apply(kv[0]);\n                if (keyFilter.test(key)) {\n                    append(document, keyPrefixer.apply(key), valueTrimmer.apply(bracketStrip.apply(kv[1])));\n                }\n            }\n        };\n    }\n\n    private Function<String, String> buildTrimmer(String trim) {\n        if (trim == null) {\n            return val -> val;\n        } else {\n            Pattern pattern = Pattern.compile(\"(^([\" + trim + \"]+))|([\" + trim + \"]+$)\");\n            return val -> {\n                try {\n                    return pattern.matcher(val).replaceAll(\"\");\n                } catch (Exception | StackOverflowError error) {","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/KeyValueProcessor.java#L142-L178","documentation":"Thrown by KeyValueProcessor when valueSplitter.apply(part) returns an array whose length is not exactly 2 — meaning the part did not contain the configured value_split token, so it can't be split into a key/value pair. IllegalArgumentException naming the field path and the missing value_split character.","triggerScenarios":"After splitting the field by field_split, one of the resulting segments does not contain the value_split character (e.g. value_split='=' but segment is 'foo' with no '=').","commonSituations":"Inconsistent log formatting where some segments lack the delimiter, wrong value_split character chosen, segments are flags without values, or trailing separators producing empty segments.","solutions":["Verify the value_split character matches the actual delimiter in all segments.","Pre-clean the input string to remove segments without the delimiter.","Use a script processor to filter malformed segments before kv.","Choose a field_split that doesn't produce empty/malformed segments."],"exampleFix":"// before\n{\"kv\": {\"field\": \"msg\", \"field_split\": \" \", \"value_split\": \"=\"}}\n// msg = 'a=1 b c=3'\n// after\n{\"script\": {\"source\": \"ctx.msg = ctx.msg.splitOnToken(' ').findAll{ it.contains('=') }.join(' ')\"}},\n{\"kv\": {\"field\": \"msg\", \"field_split\": \" \", \"value_split\": \"=\"}}","handlingStrategy":"validation","validationCode":"// Pre-validate each segment contains the value_split character\nString value = doc.getFieldValue(path, String.class);\nfor (String part : fieldSplit.split(value)) {\n    if (!part.contains(valueSplit)) {\n        // either fix the data, change value_split, or skip the doc\n    }\n}","typeGuard":"static boolean allSegmentsHaveSplit(String value, String fieldSplit, String valueSplit) {\n    for (String p : value.split(Pattern.quote(fieldSplit))) {\n        if (!p.contains(valueSplit)) return false;\n    }\n    return true;\n}","tryCatchPattern":"try {\n    kvProcessor.execute(doc);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"does not contain value_split\")) {\n        // pre-clean value or route to failure store\n    } else throw e;\n}","preventionTips":["Choose field_split and value_split that match all expected data shapes.","Pre-clean input to drop segments without the delimiter.","Add a script processor to normalize the data before kv."],"tags":["ingest","kv","delimiter","data"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}