elastic/elasticsearch · error · IllegalStateException

number [{}] must be a value between 0 and 65535

Error message

number [{}] must be a value between 0 and 65535

What it means

CommunityIdProcessor.toUint16 throws IllegalStateException (not IllegalArgumentException) when the supplied seed is < 0 or > 65535 — i.e. outside the unsigned-16-bit range used for the community-id hash seed. Used by the static apply(...) helpers; the pipeline Factory separately rejects out-of-range seeds at processor-creation time with a clearer config error.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CommunityIdProcessor.java:261

                flow.icmpCode = parseIntFromObjectOrString(icmpCode, "icmp code");
            }
        }

        return flow;
    }

    @Override
    public String getType() {
        return TYPE;
    }

    /**
     * Converts an integer in the range of an unsigned 16-bit integer to a big-endian byte pair
     */
    // visible for testing
    static byte[] toUint16(int num) {
        if (num < 0 || num > 65535) {
            throw new IllegalStateException("number [" + num + "] must be a value between 0 and 65535");
        }
        return new byte[] { (byte) (num >> 8), (byte) num };
    }

    /**
     * Attempts to coerce an object to an integer
     */
    private static int parseIntFromObjectOrString(Object o, String fieldName) {
        if (o == null) {
            return 0;
        } else if (o instanceof Number number) {
            return number.intValue();
        } else if (o instanceof String string) {
            try {
                return Integer.parseInt(string);
            } catch (NumberFormatException e) {
                // fall through to IllegalArgumentException below
            }

View on GitHub (pinned to db6a809a66)

Solutions

1. Mask the caller-provided seed to 16 bits before calling apply, e.g. seed &= 0xFFFF after rejecting negatives.
2. Pre-validate seed is in [0,65535] and throw a domain-meaningful error before calling apply.
3. Prefer constructing a CommunityIdProcessor via its Factory (which performs the same range check at config time) over the static apply API.
4. Catch IllegalStateException separately if you must accept arbitrary seed inputs.

Example fix

// before — unchecked seed
//   String id = CommunityIdProcessor.apply(src, dst, iana, t, sp, dp, it, ic, seed);
//
// after — validate / clamp before calling
//   if (seed < 0 || seed > 65535) throw new IllegalArgumentException("seed out of range: " + seed);
//   String id = CommunityIdProcessor.apply(src, dst, iana, t, sp, dp, it, ic, seed);

boolean isValidSeed(int seed) { return seed >= 0 && seed <= 65535; }

try {
    byte[] seed = CommunityIdProcessor.toUint16(value);
} catch (IllegalStateException e) {
    // caller supplied an out-of-range seed; reject before hashing
    throw new IllegalArgumentException("seed out of range: " + value, e);
}

When it happens

Trigger: Calling CommunityIdProcessor.apply(..., seed) directly with seed < 0 or > 65535. The instance pipeline path stores the seed as a byte[] at construction time and never reaches toUint16 at runtime, so this throw is a programmatic-API-only failure.

Common situations: Custom wrappers or tests passing an unchecked int seed; downstream code deriving seed from a hash without masking to 16 bits; refactoring that bypasses the Factory validation.

Related errors

• unable to construct flow from document
• invalid source port [{}]
• invalid destination port [{}]
• unable to parse {} [{}]
• invalid transport protocol number [{}]

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/09ee6209ebb4519d. Report an issue: GitHub.