elastic/elasticsearch · error · IllegalArgumentException

Invalid IP address format

Error message

Invalid IP address format

What it means

CefParser.toIP delegates to InetAddresses.forString and re-wraps any IllegalArgumentException it throws, attaching the original as cause. Applies to CEF extensions mapped to DataType.IPType (src, dst, shost, dhost, agt, etc.). Both IPv4 and IPv2 textual forms are accepted by the underlying parser.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java:576

    // visible for testing
    String toMACAddress(String v) throws IllegalArgumentException {
        // Insert separators if necessary
        String macWithSeparators = insertMACSeparators(v);
        // Validate MAC address format
        Matcher matcher = MAC_ADDRESS_PATTERN.matcher(macWithSeparators);
        if (matcher.matches() == false) {
            throw new IllegalArgumentException("Invalid MAC address format");
        }
        return macWithSeparators;
    }

    // visible for testing
    String toIP(String v) {
        try {
            return NetworkAddress.format(InetAddresses.forString(v));
        } catch (IllegalArgumentException e) {
            throw new IllegalArgumentException("Invalid IP address format", e);
        }
    }

    private static String insertMACSeparators(String v) {
        // Check that the length is correct for a MAC address without separators.
        // And check that there isn't already a separator in the string.
        if ((v.length() != EUI48_HEX_LENGTH && v.length() != EUI64_HEX_LENGTH)
            || v.charAt(2) == ':'
            || v.charAt(2) == '-'
            || v.charAt(4) == '.') {
            return v;
        }
        StringBuilder sb = new StringBuilder(EUI64_HEX_WITH_SEPARATOR_MAX_LENGTH);
        for (int i = 0; i < v.length(); i++) {
            sb.append(v.charAt(i));
            if (i < v.length() - 1 && i % 2 != 0) {
                sb.append(':');
            }

View on GitHub (pinned to db6a809a66)

Solutions

1. Ensure the source field contains only a literal IPv4 or IPv6 address (no hostnames, no CIDR prefixes, no zone identifiers).
2. Pre-resolve or pre-strip hostnames/scope IDs before the cef processor using a script.
3. Use on_failure to quarantine events with unparseable addresses.
4. If the value is a CIDR, extract the host portion first.

Example fix

// before — value is not a bare IP literal
//   field: 'CEF:0|v|p|1.0|1|n|3|src=host.example.com next=...'
//
// after — value is a literal IPv4/IPv6 address
//   field: 'CEF:0|v|p|1.0|1|n|3|src=192.168.1.10 next=...'

// Use the same library the parser uses.
import com.google.common.net.InetAddresses;
boolean isParsableIp(String v) {
    if (v == null) return false;
    try { InetAddresses.forString(v); return true; }
    catch (IllegalArgumentException e) { return false; }
}

{
  "on_failure": [
    { "set": { "field": "ingest.error", "value": "cef-bad-ip" } },
    { "redirect": { "pipeline": "quarantine" } }
  ]
}

When it happens

Trigger: An IP-typed extension value that is not a valid IPv4 or IPv6 literal: '192.168.1.999', 'not-an-ip', 'fe80::1%eth0' (zone id not supported by Guava's InetAddresses.forString), or a hostname mistakenly placed in the field.

Common situations: Producer writes a hostname or domain into an IP field; address has a scope/zone suffix; leading/trailing whitespace survived sanitization; malformed octet from a buggy packet decoder.

Related errors

• Invalid MAC address format
• Unable to find pattern [{}] in Grok's pattern dictionary
• circular reference in pattern back [{}]
• Can not convert grok patterns to regular expression
• unsupported ECS compatibility mode [{}]

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/5974a0d3ec5e7655. Report an issue: GitHub.