elastic/elasticsearch · error · IllegalArgumentException

'{}' is not a valid field reference

Error message

'{}' is not a valid field reference

What it means

Thrown in the DataStreamValueSource constructor when a value contains mustache-style field-reference markers ('{{' or '}}') but does not strictly start with '{{' and end with '}}'. This guards against malformed field references in reroute type/dataset/namespace config.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/RerouteProcessor.java:248

        public static DataStreamValueSource type(String type) {
            return new DataStreamValueSource(type, DataStream::sanitizeType);
        }

        public static DataStreamValueSource dataset(String dataset) {
            return new DataStreamValueSource(dataset, DataStream::sanitizeDataset);
        }

        public static DataStreamValueSource namespace(String namespace) {
            return new DataStreamValueSource(namespace, DataStream::sanitizeNamespace);
        }

        private DataStreamValueSource(String value, Function<String, String> sanitizer) {
            this.sanitizer = sanitizer;
            this.value = value;
            if (value.contains("{{") || value.contains("}}")) {
                if (value.startsWith("{{") == false || value.endsWith("}}") == false) {
                    throw new IllegalArgumentException("'" + value + "' is not a valid field reference");
                }
                String fieldReference = value.substring(2, value.length() - 2);
                // field references may have two or three curly braces
                if (fieldReference.startsWith("{") && fieldReference.endsWith("}")) {
                    fieldReference = fieldReference.substring(1, fieldReference.length() - 1);
                }
                fieldReference = fieldReference.trim();
                // only a single field reference is allowed
                // so something like this is disallowed: {{foo}}-{{bar}}
                if (fieldReference.contains("{") || fieldReference.contains("}")) {
                    throw new IllegalArgumentException("'" + value + "' is not a valid field reference");
                }
                this.fieldReference = fieldReference;
            } else {
                this.fieldReference = null;
                if (Objects.equals(sanitizer.apply(value), value) == false) {
                    throw new IllegalArgumentException("'" + value + "' contains disallowed characters");
                }

View on GitHub (pinned to db6a809a66)

Solutions

1. Use a single complete field reference: '{{field_name}}' or '{{{field_name}}}'.
2. For static (non-interpolated) values, remove all '{{' and '}}' markers.
3. If you need multiple fields, resolve them upstream with a script processor and reference the combined result.

Example fix

// before
{
  "reroute": { "dataset": "{{service}}-{{env}}" }
}
// after (use a single field, or precompute upstream)
{
  "reroute": { "dataset": "{{service_and_env}}" }
}

// Validate a reroute field reference value is well-formed
String v = "{{service}}"; // example config value
if (v.contains("{{") || v.contains("}}")) {
    if (!v.startsWith("{{") || !v.endsWith("}}")) {
        throw new IllegalArgumentException("malformed field reference: " + v);
    }
}

boolean isWellFormedFieldRef(String value) {
    if (value == null) return false;
    if (value.contains("{{") || value.contains("}}")) {
        return value.startsWith("{{") && value.endsWith("}}");
    }
    return true;
}

try {
    // build/run reroute processor config
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("is not a valid field reference")) {
        // fix config: use a single complete {{field}} reference
    } else { throw e; }
}

When it happens

Trigger: Configuring reroute with a type, dataset, or namespace value like 'foo{{bar' or '{{foo}}-{{bar}}' that includes curly markers but is not a single clean field reference of the form '{{fieldname}}' or '{{{fieldname}}}'.

Common situations: Attempting to interpolate multiple fields in one segment (e.g., '{{a}}-{{b}}'). Using unbalanced or stray curly braces in static values. Copy-paste errors from mustache templates.

Related errors

• invalid data stream name: [{}]; must follow naming scheme <t
• '{}' contains disallowed characters
• field [{}] of type [{}] cannot be cast to [{}]
• failure store document has unexpected structure, missing req
• failure store document has unexpected structure, missing req

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/204ddfe677aeb108. Report an issue: GitHub.