elastic/elasticsearch · error · IllegalArgumentException

Invalid extensions in the CEF event: {}

Error message

Invalid extensions in the CEF event: {}

What it means

Thrown by CefParser.parseExtensions when splitting the extension string on '=' produced exactly one chunk that is non-empty. Because every CEF extension is a key=value pair, a single non-empty chunk means no '=' separator was found at all, so the input cannot be turned into a key/value map. The empty case returns Map.of() instead of throwing.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java:411

                } else {
                    throw new IllegalArgumentException("Illegal escape sequence '\\" + next + "'"); // TODO gross on \n, for example ugh
                }
                i++; // and skip the next character
            } else if (curr == '=') { // an equals, it's the end of a chunk
                chunks.add(buffer.toString()); // emit the chunk
                buffer = new StringBuilder(); // and reset the buffer
            } else { // any other character
                buffer.append(curr); // is just added to the current thing
            }
        }
        chunks.add(buffer.toString()); // don't forget the ragged-edge last chunk ;)

        if (chunks.size() == 1) {
            String chunk = chunks.getFirst();
            if (chunk.isEmpty()) {
                return Map.of();
            } else {
                throw new IllegalArgumentException("Invalid extensions in the CEF event: " + chunk);
            }
        }

        // now turn chunks into pairs by splitting on the last space character
        // given 'foo', 'bar\bar = bar baz ', 'quux ', we want to end up with { 'foo': 'bar\bar = bar ', 'baz': 'quux'}
        Map<String, String> extensions = HashMap.newHashMap(chunks.size() - 1);
        String key, value, chunk;
        key = chunks.getFirst();
        if (key.isEmpty() || containsWhitespace(key)) {
            throw new IllegalArgumentException(UNESCAPED_EQUALS_SIGN); // TODO I'm not sure this error message is actually fair anymore
        }
        for (int j = 1; j < chunks.size() - 1; j++) {
            chunk = chunks.get(j);
            int idx = chunk.lastIndexOf(' ');
            if (idx == -1) {
                value = "";
            } else {
                value = chunk.substring(0, idx);

View on GitHub (pinned to db6a809a66)

Solutions

1. Verify the full CEF line is reaching the processor intact — inspect the raw field value in _source.
2. Route failing documents to an on_failure pipeline and log the offending value for producer-side correction.
3. Pre-validate that the field contains at least one '=' after the CEF header before sending it to the cef processor.
4. If the field is legitimately empty for some events, leave it empty (an empty extension string returns an empty map, no throw).

Example fix

// before — no '=' in the extension segment
//   field: 'CEF:0|v|p|1.0|1|n|3|lonelytoken'
//
// after — ensure the extension section contains at least one key=value pair
//   field: 'CEF:0|v|p|1.0|1|n|3|act=lonelytoken'

// A well-formed CEF extension section contains at least one '='.
boolean hasKeyValueSeparator(String ext) {
    return ext != null && !ext.isBlank() && ext.indexOf('=') >= 0;
}

{
  "on_failure": [
    { "set": { "field": "ingest.error", "value": "cef-no-extension-separator" } },
    { "redirect": { "pipeline": "quarantine" } }
  ]
}

When it happens

Trigger: Calling CefProcessor on a CEF event whose extension section is a single bare token with no '=' — e.g. 'CEF:0|v|p|1.0|1|n|3|justtext' (extension segment is 'justtext'), or a truncated/malformed line where the trailing key=value pairs were stripped.

Common situations: Producer truncates the message before emitting any extension pair; a log shipper splits the CEF line on a delimiter and drops the tail; the test fixture omits the extension block; an upstream grok pattern captured only the header into the cef field.

Related errors

• CEF extensions contain unescaped equals sign
• Illegal escape sequence '\{}'
• Value is not a valid timestamp: {}
• unable to parse URI [${uriString}]
• Invalid CEF format

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/887e62a7537ca248. Report an issue: GitHub.