elastic/elasticsearch · error · IllegalArgumentException

Invalid CEF format

Error message

Invalid CEF format

What it means

IllegalArgumentException(INVALID_CEF_FORMAT) from parseHeaders when the parsed header list is empty or the first header does not start with 'CEF:'. CEF (Common Event Format) mandates a leading 'CEF:version|...' token; anything else is rejected before field-count validation.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java:317

                buffer.append('\\'); // emit a backslash
                i++; // and skip the next character
            } else if (curr == '\\' && next == '|') { // an escaped pipe
                buffer.append('|'); // emit a pipe
                i++; // and skip the next character
            } else if (curr == '|') { // a pipe, it's the end of a header
                headers.add(buffer.toString()); // emit the header
                buffer = new StringBuilder(); // and reset the buffer
                if (headers.size() == 7) {
                    extensionStart = i + 1; // the extensions begin after this pipe
                    break; // we've processed all the headers, so exit the loop
                }
            } else { // any other character
                buffer.append(curr); // is just added to the header
            }
        }

        if (headers.isEmpty() || headers.getFirst().startsWith("CEF:") == false) {
            throw new IllegalArgumentException(INVALID_CEF_FORMAT);
        }

        if (headers.size() != 7) {
            throw new IllegalArgumentException(INCOMPLETE_CEF_HEADER);
        }

        // for simplicity of the interface, pack the unparsed extension string itself into the returned list of headers
        String extensionString = cefString.substring(extensionStart);
        headers.add(extensionString);

        return headers;
    }

    private static void processHeaders(List<String> headers, CefEvent event) {
        for (int i = 0; i < headers.size(); i++) {
            final String value = headers.get(i);
            switch (i) {
                case 0 -> event.addCefMapping("version", value.substring(4));

View on GitHub (pinned to db6a809a66)

Solutions

1. Ensure the input string starts with a CEF version token, e.g. 'CEF:0|vendor|product|1.0|100|name|6|...'
2. Verify the upstream producer emits CEF and not another format
3. If using a multiline codec, collapse to a single CEF line before this processor

Example fix

// before: field document = "vendor|product|1.0|..."  // missing CEF:0 prefix
// after
"CEF:0|Vendor|Product|1.0|100|Event Name|6|act=blocked dst=10.0.0.1"

// Reject non-CEF input before the CEF processor:
String first = input.isBlank() ? "" : input.substring(0, Math.min(input.length(),4));
if (input.isBlank() || !input.startsWith("CEF:")) {
    throw new IllegalArgumentException("Invalid CEF format");
}

try { cefProcessor.execute(doc); }
catch (IllegalArgumentException e) {
    if ("Invalid CEF format".equals(e.getMessage())) { routeToNonCefPipeline(doc); }
    else throw e;
}

When it happens

Trigger: The Cef ingest processor receives a string that is empty, does not begin with 'CEF:', or whose first pipe-delimited token isn't a CEF version token. Line 316 check fails.

Common situations: Feeding raw syslog/JSON instead of CEF; truncated first field; LE EF (LEEF) format confused with CEF; encoding/prefix stripping by a shipper.

Related errors

• Incomplete CEF header
• Error parsing document in field [{}]
• Illegal escape sequence '\{}'
• Invalid extensions in the CEF event: {}
• CEF extensions contain unescaped equals sign

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/a368ab03b3cd56c9. Report an issue: GitHub.