elastic/elasticsearch · error · IllegalArgumentException

invalid destination port [{}]

Error message

invalid destination port [{}]

What it means

Destination-port twin of error 1110: for Tcp/Udp/Sctp flows, the parsed destination port must be 1..65535. A null destinationPort resolves to 0 and throws. destinationPort.get() is interpolated into the message.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java:237

        Object protocol = ianaNumber;
        if (protocol == null) {
            protocol = transport.get();
            if (protocol == null) {
                return null;
            }
        }
        flow.protocol = Transport.fromObject(protocol);

        switch (flow.protocol.getType()) {
            case Tcp, Udp, Sctp -> {
                flow.sourcePort = parseIntFromObjectOrString(sourcePort.get(), "source port");
                if (flow.sourcePort < 1 || flow.sourcePort > 65535) {
                    throw new IllegalArgumentException("invalid source port [" + sourcePort.get() + "]");
                }
                flow.destinationPort = parseIntFromObjectOrString(destinationPort.get(), "destination port");
                if (flow.destinationPort < 1 || flow.destinationPort > 65535) {
                    throw new IllegalArgumentException("invalid destination port [" + destinationPort.get() + "]");
                }
            }
            case Icmp, IcmpIpV6 -> {
                // tolerate missing or invalid ICMP types and codes
                flow.icmpType = parseIntFromObjectOrString(icmpType, "icmp type");
                flow.icmpCode = parseIntFromObjectOrString(icmpCode, "icmp code");
            }
        }

        return flow;
    }

    @Override
    public String getType() {
        return TYPE;
    }

    /**

View on GitHub (pinned to db6a809a66)

Solutions

1. Ensure destination.port is an integer in [1,65535] for TCP/UDP/SCTP flows.
2. Use ICMP/IcmpIpV6 transport when ports are not meaningful for the flow.
3. Pre-populate the field correctly upstream or drop such documents before community_id.
4. Use on_failure to quarantine.

Example fix

// before — destination.port is 0
//   { "destination": { "ip": "10.0.0.2", "port": 0 }, "network": { "transport": "tcp" } }
//
// after — destination.port in range
//   { "destination": { "ip": "10.0.0.2", "port": 443 }, "network": { "transport": "tcp" } }

boolean isValidPort(Object o) {
    if (o instanceof Number n) { int p = n.intValue(); return p >= 1 && p <= 65535; }
    if (o instanceof String s && s.matches("-?\\d+")) {
        int p = Integer.parseInt(s); return p >= 1 && p <= 65535;
    }
    return false;
}

{
  "community_id": {
    "on_failure": [
      { "set": { "field": "ingest.error", "value": "community-id-bad-destination-port" } },
      { "redirect": { "pipeline": "quarantine" } }
    ]
  }
}

When it happens

Trigger: destination.port is 0, > 65535, negative, or absent (parses to 0) while transport is TCP/UDP/SCTP.

Common situations: Same as 1110 but on the destination side: unidirectional sensors, ICMP events mistakenly tagged as UDP, mis-typed port fields.

Related errors

• invalid source port [{}]
• unable to parse {} [{}]
• invalid transport protocol number [{}]
• could not convert string [{}] to transport protocol
• Unable to find pattern [{}] in Grok's pattern dictionary

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/bad38e4729cde20c. Report an issue: GitHub.