elastic/elasticsearch · error · IllegalArgumentException

could not convert value of type [{}] to transport protocol

Error message

could not convert value of type [{}] to transport protocol

What it means

Transport.fromObject only accepts Number or String inputs. Any other runtime type — Boolean, List, Map, Object[] — yields this exception with the fully-qualified class name interpolated. This is a type-shape failure, not a value failure.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java:511

            if (o instanceof Number number) {
                return fromNumber(number.intValue());
            } else if (o instanceof String protocolStr) {
                // check if matches protocol name
                if (Type.TRANSPORT_NAMES.containsKey(protocolStr.toLowerCase(Locale.ROOT))) {
                    return new Transport(Type.TRANSPORT_NAMES.get(protocolStr.toLowerCase(Locale.ROOT)));
                }

                // check if convertible to protocol number
                try {
                    int protocolNumber = Integer.parseInt(protocolStr);
                    return fromNumber(protocolNumber);
                } catch (NumberFormatException e) {
                    // fall through to IllegalArgumentException
                }

                throw new IllegalArgumentException("could not convert string [" + protocolStr + "] to transport protocol");
            } else {
                throw new IllegalArgumentException(
                    "could not convert value of type [" + o.getClass().getName() + "] to transport protocol"
                );
            }
        }
    }

    public enum IcmpType {
        EchoReply(0),
        EchoRequest(8),
        RouterAdvertisement(9),
        RouterSolicitation(10),
        TimestampRequest(13),
        TimestampReply(14),
        InfoRequest(15),
        InfoReply(16),
        AddressMaskRequest(17),
        AddressMaskReply(18),
        V6EchoRequest(128),

View on GitHub (pinned to db6a809a66)

Solutions

1. Ensure the field holds a single scalar value (Number or String) before community_id runs.
2. If the field is multi-valued, pick one element (e.g. the first) or split the document upstream.
3. Fix the index mapping so the field is keyword/long rather than object/boolean.
4. Quarantine via on_failure.

Example fix

// before — protocol field is a list
//   { "network": { "transport": ["tcp", "udp"] } }
//
// after — single scalar value
//   { "network": { "transport": "tcp" } }

boolean isScalarProtocol(Object o) {
    return o == null || o instanceof Number || o instanceof String;
}

static boolean isScalarProtocol(Object o) {
    return o == null || o instanceof Number || o instanceof String;
}

{
  "community_id": {
    "on_failure": [
      { "set": { "field": "ingest.error", "value": "community-id-non-scalar-transport" } },
      { "redirect": { "pipeline": "quarantine" } }
    ]
  }
}

When it happens

Trigger: network.iana_number or network.transport is a Boolean (e.g. from a mis-mapped yes/no field), a List (multi-valued field), a Map, or some custom object. Only Number and String are accepted.

Common situations: Field mapped as object/boolean in the index but used as protocol input; multi-valued field where the source has two transports; script processor that returned a non-scalar; CSV ingest with parsing artifacts producing arrays.

Related errors

• invalid transport protocol number [{}]
• could not convert string [{}] to transport protocol
• unable to construct flow from document
• invalid source port [{}]
• invalid destination port [{}]

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/cb3a744a7e782202. Report an issue: GitHub.