{"record":{"id":"f30f2073a6de1ae3","repo":"elastic/elasticsearch","slug":"field-is-null-cannot-process-it-f30f20","errorCode":null,"errorMessage":"field [{}] is null, cannot process it.","messagePattern":"field \\[(.+?)\\] is null, cannot process it\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefProcessor.java","lineNumber":59,"sourceCode":"        boolean ignoreMissing,\n        boolean ignoreEmptyValues,\n        @Nullable TemplateScript.Factory timezone\n    ) {\n        super(tag, description);\n        this.field = field;\n        this.targetField = targetField;\n        this.ignoreMissing = ignoreMissing;\n        this.ignoreEmptyValues = ignoreEmptyValues;\n        this.timezone = timezone;\n    }\n\n    @Override\n    public IngestDocument execute(IngestDocument document) {\n        String line = document.getFieldValue(field, String.class, ignoreMissing);\n        if (line == null && ignoreMissing) {\n            return document;\n        } else if (line == null) {\n            throw new IllegalArgumentException(\"field [\" + field + \"] is null, cannot process it.\");\n        }\n        ZoneId timezone = getTimezone(document);\n        try (CefEvent event = new CefParser(timezone, ignoreEmptyValues).process(line)) {\n            event.getRootMappings().forEach(document::setFieldValue);\n            event.getCefMappings().forEach((k, v) -> document.setFieldValue(targetField + \".\" + k, v));\n        }\n        return document;\n    }\n\n    @Override\n    public String getType() {\n        return TYPE;\n    }\n\n    ZoneId getTimezone(IngestDocument document) {\n        String value = timezone == null ? null : document.renderTemplate(timezone);\n        if (value == null) {\n            return ZoneOffset.UTC;","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefProcessor.java#L41-L77","documentation":"CefProcessor.execute fetches the configured source field; if the value is null and ignore_missing is false (the default), it throws. This is a pipeline-level guard: it fires before CefParser is even constructed, so no CEF-specific validation has run yet.","triggerScenarios":"A document reaches the cef processor whose 'field' (default 'message') is absent, explicitly null, or was dropped by an earlier processor. With ignore_missing=false (default), every such document throws.","commonSituations":"Documents whose source field name differs from the configured 'field'; conditional pipelines where some events legitimately lack the CEF line; an upstream drop/nullify processor ran before cef; mis-typed field path.","solutions":["Set ignore_missing: true on the cef processor if missing values are expected — those documents pass through unchanged.","Verify the configured 'field' path matches the document's actual CEF-bearing field.","Ensure upstream processors do not null/remove the field before cef runs.","Place an on_failure pipeline if you prefer to quarantine rather than skip."],"exampleFix":"// before — default config, missing field fails the document\n//   { \"cef\": { \"field\": \"message\" } }\n//\n// after — tolerate absent fields\n//   { \"cef\": { \"field\": \"message\", \"ignore_missing\": true } }","handlingStrategy":"validation","validationCode":"// In a pipeline, the simplest guard is ignore_missing. In Java:\nboolean shouldRunCef(IngestDocument doc, String field) {\n    return doc.hasField(field) && doc.getFieldValue(field, Object.class) != null;\n}","typeGuard":null,"tryCatchPattern":"{\n  \"cef\": {\n    \"field\": \"message\",\n    \"ignore_missing\": true,\n    \"on_failure\": [\n      { \"set\": { \"field\": \"ingest.error\", \"value\": \"cef-missing-field\" } },\n      { \"redirect\": { \"pipeline\": \"quarantine\" } }\n    ]\n  }\n}","preventionTips":["Default to ignore_missing: true for cef processors in mixed pipelines.","Verify the configured field path matches your document schema.","Do not run drop/null processors before cef on the same field."],"tags":["ingest","cef","missing-field","config"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}