elastic/elasticsearch · error · IllegalArgumentException

could not convert string [{}] to transport protocol

Error message

could not convert string [{}] to transport protocol

What it means

Transport.fromObject, given a String that is neither a known transport name (matched case-insensitively against TRANSPORT_NAMES) nor parseable by Integer.parseInt, throws this. The literal offending string is interpolated. Compare with 1114 (numeric out of range) and 1116 (non-String/Number type).

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java:509

        private static Transport fromObject(Object o) {
            if (o instanceof Number number) {
                return fromNumber(number.intValue());
            } else if (o instanceof String protocolStr) {
                // check if matches protocol name
                if (Type.TRANSPORT_NAMES.containsKey(protocolStr.toLowerCase(Locale.ROOT))) {
                    return new Transport(Type.TRANSPORT_NAMES.get(protocolStr.toLowerCase(Locale.ROOT)));
                }

                // check if convertible to protocol number
                try {
                    int protocolNumber = Integer.parseInt(protocolStr);
                    return fromNumber(protocolNumber);
                } catch (NumberFormatException e) {
                    // fall through to IllegalArgumentException
                }

                throw new IllegalArgumentException("could not convert string [" + protocolStr + "] to transport protocol");
            } else {
                throw new IllegalArgumentException(
                    "could not convert value of type [" + o.getClass().getName() + "] to transport protocol"
                );
            }
        }
    }

    public enum IcmpType {
        EchoReply(0),
        EchoRequest(8),
        RouterAdvertisement(9),
        RouterSolicitation(10),
        TimestampRequest(13),
        TimestampReply(14),
        InfoRequest(15),
        InfoReply(16),
        AddressMaskRequest(17),

View on GitHub (pinned to db6a809a66)

Solutions

1. Map the producer's protocol identifier to a supported name (tcp, udp, sctp, icmp, icmpv6, igmp, gre, eigrp, ospf, pim) or to a numeric IANA value before community_id runs.
2. Strip whitespace and lowercase the value upstream.
3. Fall back to providing network.iana_number instead of network.transport if your transport names are non-standard.
4. Quarantine via on_failure.

Example fix

// before — non-standard transport name
//   { "network": { "transport": "tcp6" } }
//
// after — recognized name or numeric IANA protocol number
//   { "network": { "transport": "tcp" } }

private static final java.util.Set<String> NAMES = java.util.Set.of(
    "tcp","udp","sctp","icmp","icmpv6","igmp","gre","eigrp","ospf","pim");
boolean isRecognizedTransportString(String s) {
    if (s == null) return false;
    String lc = s.toLowerCase(java.util.Locale.ROOT).trim();
    return NAMES.contains(lc) || lc.matches("[+-]?\\d+");
}

static boolean isTransportable(Object o) {
    if (o instanceof Number) return true;
    if (o instanceof String s) return s.matches("[+-]?\\d+")
        || java.util.Set.of("tcp","udp","sctp","icmp","icmpv6","igmp","gre","eigrp","ospf","pim")
            .contains(s.toLowerCase(java.util.Locale.ROOT).trim());
    return false;
}

{
  "community_id": {
    "on_failure": [
      { "set": { "field": "ingest.error", "value": "community-id-bad-transport-name" } },
      { "redirect": { "pipeline": "quarantine" } }
    ]
  }
}

When it happens

Trigger: network.transport = 'tcp6', 'TLS', 'icmp4', 'unknown', or any string that is neither a recognized protocol name nor an integer. Numeric strings that parse but fall outside the IANA range throw 1114 instead.

Common situations: Producer uses non-standard protocol names; mixed-case variants ('Tcp', 'TCP ') not in the name table; trailing whitespace; values like 'TCP/UDP' that include both.

Related errors

• invalid transport protocol number [{}]
• invalid source port [{}]
• invalid destination port [{}]
• unable to parse {} [{}]
• could not convert value of type [{}] to transport protocol

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/7679f8e1fec73a45. Report an issue: GitHub.