elastic/elasticsearch · error · IllegalArgumentException

Illegal escape sequence '\{}'

Error message

Illegal escape sequence '\{}'

What it means

Thrown by CefParser.parseExtensions while scanning a CEF event's extension section. CEF permits only five backslash escapes (\\, \=, \n, \r, \t); any backslash immediately followed by a different character — or by end-of-string — is rejected. The exception propagates out of CefProcessor.execute and fails the ingest document.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java:394

            }
        }
        for (; i < extensionString.length(); i++) {
            char curr = extensionString.charAt(i);
            char next = i < extensionString.length() - 1 ? extensionString.charAt(i + 1) : '\0';

            if (curr == '\\') {
                if (next == '\\') { // an escaped backslash
                    buffer.append('\\'); // emit a backslash
                } else if (next == '=') { // an escaped equals
                    buffer.append('='); // emit an equals
                } else if (next == 'n') { // a 'newline'
                    buffer.append('\n'); // emit a newline
                } else if (next == 'r') { // a 'carriage return'
                    buffer.append('\r'); // emit a carriage return
                } else if (next == 't') { // a 'tab' -- the spec doesn't actually mention \t being escaped into a tab, but we do it anyway
                    buffer.append('\t'); // emit a tab
                } else {
                    throw new IllegalArgumentException("Illegal escape sequence '\\" + next + "'"); // TODO gross on \n, for example ugh
                }
                i++; // and skip the next character
            } else if (curr == '=') { // an equals, it's the end of a chunk
                chunks.add(buffer.toString()); // emit the chunk
                buffer = new StringBuilder(); // and reset the buffer
            } else { // any other character
                buffer.append(curr); // is just added to the current thing
            }
        }
        chunks.add(buffer.toString()); // don't forget the ragged-edge last chunk ;)

        if (chunks.size() == 1) {
            String chunk = chunks.getFirst();
            if (chunk.isEmpty()) {
                return Map.of();
            } else {
                throw new IllegalArgumentException("Invalid extensions in the CEF event: " + chunk);
            }

View on GitHub (pinned to db6a809a66)

Solutions

1. Sanitize the source value before the cef processor: replace each '\' that is not followed by one of \,=,n,r,t with '\\' (double-escape) using a script/grok pre-processor.
2. Strip or trim a trailing lone backslash from the field before it reaches the cef processor.
3. Attach an on_failure pipeline to the cef processor and route the failing document there instead of failing the bulk request.
4. If escaping cannot be fixed upstream, file an issue with the CEF producer — its data is not spec-compliant.

Example fix

// before — value carries an unescaped Windows path
//  field: 'CEF:0|vendor|prod|1.0|100|test|3|suser=C:\\Windows\\system32'
//  -> parseExtensions sees '\\W' and throws.
//
// after — pre-escape backslashes in a script processor so each '\' becomes '\\'
{
  "script": {
    "source": "ctx[params.field] = ctx[params.field].replace(/\\(?![\\=nrt])/,'\\\\\\\\'); "
  }
}

// Reject input that contains a backslash not followed by an allowed escape target.
private static final Pattern BAD_ESCAPE = Pattern.compile("\\\\(?![\\\\=nrt])");
boolean isSafeForCefExtensions(String ext) {
    return ext == null || !BAD_ESCAPE.matcher(ext).find();
}

// Inside an Elasticsearch pipeline — route CEF failures to a quarantine pipeline.
{
  "on_failure": [
    { "set": { "field": "ingest.error", "value": "cef-escape" } },
    { "redirect": { "pipeline": "quarantine" } }
  ]
}

When it happens

Trigger: A CEF extension string containing a backslash before an unsupported character — e.g. a Windows path 'C:\Windows' (yields '\W'), a regex '\d+', a literal '\u0000', or a trailing '\' at the final position of the string. Calling CefParser.process on such a line throws immediately during parseExtensions.

Common situations: Ingesting syslog/CEF feeds from security products (IPS/EDR) whose payload contains Windows file paths, registry keys, or regex text that the producer did not CEF-escape. Also seen after a forwarder strips or rewrites backslashes, and when test fixtures are authored without doubling backslashes.

Related errors

• Invalid extensions in the CEF event: {}
• CEF extensions contain unescaped equals sign
• Value is not a valid timestamp: {}
• unable to parse URI [${uriString}]
• Invalid CEF format

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/094561cb13ed98d6. Report an issue: GitHub.