elastic/elasticsearch · error · IllegalArgumentException

field [{}] does not contain value_split [{}]

Error message

field [{}] does not contain value_split [{}]

What it means

Thrown by KeyValueProcessor when valueSplitter.apply(part) returns an array whose length is not exactly 2 — meaning the part did not contain the configured value_split token, so it can't be split into a key/value pair. IllegalArgumentException naming the field path and the missing value_split character.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/KeyValueProcessor.java:160

            String path = document.renderTemplate(field);
            if (path.isEmpty() || document.hasField(path, true) == false) {
                if (ignoreMissing) {
                    return;
                } else {
                    throw new IllegalArgumentException("field [" + path + "] doesn't exist");
                }
            }
            String value = document.getFieldValue(path, String.class, ignoreMissing);
            if (value == null) {
                if (ignoreMissing) {
                    return;
                }
                throw new IllegalArgumentException("field [" + path + "] is null, cannot extract key-value pairs.");
            }
            for (String part : fieldSplitter.apply(value)) {
                String[] kv = valueSplitter.apply(part);
                if (kv.length != 2) {
                    throw new IllegalArgumentException("field [" + path + "] does not contain value_split [" + valueSplit + "]");
                }
                String key = keyTrimmer.apply(kv[0]);
                if (keyFilter.test(key)) {
                    append(document, keyPrefixer.apply(key), valueTrimmer.apply(bracketStrip.apply(kv[1])));
                }
            }
        };
    }

    private Function<String, String> buildTrimmer(String trim) {
        if (trim == null) {
            return val -> val;
        } else {
            Pattern pattern = Pattern.compile("(^([" + trim + "]+))|([" + trim + "]+$)");
            return val -> {
                try {
                    return pattern.matcher(val).replaceAll("");
                } catch (Exception | StackOverflowError error) {

View on GitHub (pinned to db6a809a66)

Solutions

1. Verify the value_split character matches the actual delimiter in all segments.
2. Pre-clean the input string to remove segments without the delimiter.
3. Use a script processor to filter malformed segments before kv.
4. Choose a field_split that doesn't produce empty/malformed segments.

Example fix

// before
{"kv": {"field": "msg", "field_split": " ", "value_split": "="}}
// msg = 'a=1 b c=3'
// after
{"script": {"source": "ctx.msg = ctx.msg.splitOnToken(' ').findAll{ it.contains('=') }.join(' ')"}},
{"kv": {"field": "msg", "field_split": " ", "value_split": "="}}

// Pre-validate each segment contains the value_split character
String value = doc.getFieldValue(path, String.class);
for (String part : fieldSplit.split(value)) {
    if (!part.contains(valueSplit)) {
        // either fix the data, change value_split, or skip the doc
    }
}

static boolean allSegmentsHaveSplit(String value, String fieldSplit, String valueSplit) {
    for (String p : value.split(Pattern.quote(fieldSplit))) {
        if (!p.contains(valueSplit)) return false;
    }
    return true;
}

try {
    kvProcessor.execute(doc);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("does not contain value_split")) {
        // pre-clean value or route to failure store
    } else throw e;
}

When it happens

Trigger: After splitting the field by field_split, one of the resulting segments does not contain the value_split character (e.g. value_split='=' but segment is 'foo' with no '=').

Common situations: Inconsistent log formatting where some segments lack the delimiter, wrong value_split character chosen, segments are flags without values, or trailing separators producing empty segments.

Related errors

• Provided Grok expressions do not match field value: [{}]
• The input {} is not valid JSON and the {} parameter is true
• field [{}] doesn't exist
• field [{}] is null, cannot extract key-value pairs.
• Unable to find pattern [{}] in Grok's pattern dictionary

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/f2ca76d962768f92. Report an issue: GitHub.