elastic/elasticsearch · critical · RuntimeException

failed to load built-in patterns

Error message

failed to load built-in patterns

What it means

Thrown by GrokBuiltinPatterns.loadPatternsFromDirectory() as a RuntimeException wrapping an IOException that occurred while reading a built-in pattern resource file from the classpath. The method reads pattern files from JAR resources (e.g. /patterns/legacy/grok-patterns or /patterns/ecs-v1/aws). If any file fails to load, all loading stops and this exception propagates.

Source

Thrown at libs/grok/src/main/java/org/elasticsearch/grok/GrokBuiltinPatterns.java:133

            "postgresql",
            "rails",
            "redis",
            "ruby",
            "squid",
            "zeek"
        );
        return loadPatternsFromDirectory(patternNames, "/patterns/ecs-v1/");
    }

    private static PatternBank loadPatternsFromDirectory(List<String> patternNames, String directory) {
        Map<String, String> builtinPatterns = new LinkedHashMap<>();
        for (String pattern : patternNames) {
            try {
                try (InputStream is = GrokBuiltinPatterns.class.getResourceAsStream(directory + pattern)) {
                    loadPatternsFromFile(builtinPatterns, is);
                }
            } catch (IOException e) {
                throw new RuntimeException("failed to load built-in patterns", e);
            }
        }
        return new PatternBank(builtinPatterns);
    }

    private static void loadPatternsFromFile(Map<String, String> patternBank, InputStream inputStream) throws IOException {
        String line;
        BufferedReader br = new BufferedReader(new InputStreamReader(inputStream, StandardCharsets.UTF_8));
        while ((line = br.readLine()) != null) {
            String trimmedLine = line.replaceAll("^\\s+", "");
            if (trimmedLine.startsWith("#") || trimmedLine.length() == 0) {
                continue;
            }

            String[] parts = trimmedLine.split("\\s+", 2);
            if (parts.length == 2) {
                patternBank.put(parts[0], parts[1]);
            }

View on GitHub (pinned to db6a809a66)

Solutions

1. Inspect RuntimeException.getCause() (an IOException) for the specific I/O error.
2. Verify that the grok library JAR contains the /patterns/legacy/ and /patterns/ecs-v1/ resource directories — use jar tf or unzip -l.
3. If running from an IDE, ensure Maven/Gradle resource copying is configured (src/main/resources → target/classes).
4. If packaging a custom distribution, ensure the grok module's resources are included in the classpath.
5. Check for classloader issues in application server or modular environments that prevent getResourceAsStream from finding the resources.

try {
    PatternBank bank = GrokBuiltinPatterns.legacyPatterns();
} catch (RuntimeException e) {
    if (e.getCause() instanceof IOException) {
        // resource loading failure — check JAR contents and classpath
        logger.error("Failed to load grok built-in patterns", e);
    }
    throw e;
}

When it happens

Trigger: An IOException occurs while opening or reading a built-in pattern resource file via GrokBuiltinPatterns.class.getResourceAsStream(). This could be caused by: a missing resource file in the JAR (classpath issue), an I/O error reading the resource stream, or a corrupted JAR. The exception wraps the original IOException as the cause.

Common situations: Custom JAR packaging that excluded the /patterns/ resource directory; classloader issue in an OSGi or modular environment preventing resource loading; corrupted JAR file; security manager blocking resource access; running from an IDE where resources were not copied to the output directory.

Related errors

• Unable to find pattern [{}] in Grok's pattern dictionary
• circular reference in pattern back [{}]
• Can not convert grok patterns to regular expression
• grok pattern matching was interrupted after [{}] ms
• unsupported ECS compatibility mode [{}]

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/8d7055d14c3df8e0. Report an issue: GitHub.