What causes "Provided Grok expressions do not match field value: [{}]" in elastic/elasticsearch?

Add additional patterns that cover the unmatched log variant, or loosen existing patterns.

elastic/elasticsearch · error · IllegalArgumentException

Provided Grok expressions do not match field value

Error message

Provided Grok expressions do not match field value: [{}]

What it means

Thrown by GrokProcessor.execute when grok.captures(fieldValue) returns null, meaning none of the configured grok patterns matched the input string. This is a data/pattern mismatch — the value is non-null but no pattern captures it. IllegalArgumentException so the document fails the processor and can route to the failure pipeline.

Solutions

Add additional patterns that cover the unmatched log variant, or loosen existing patterns.
Use trace_match to identify which pattern (if any) is firing and debug non-matches.
Route non-matching documents to a different pipeline or to the failure store for separate handling.
Verify the pattern syntax against Grok debugger / Kibana Grok Debugger tool.

Example fix

// before
{"grok": {"field": "message", "patterns": ["%{COMBINEDAPACHELOG}"]}}
// after
{"grok": {"field": "message", "patterns": ["%{COMBINEDAPACHELOG}", "%{JSONLOG}"], "trace_match": true}}

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-test grok patterns against the value
Map<String,Object> test = grok.captures(sampleValue);
if (test == null) {
    // pattern doesn't match — broaden or route differently
}

Try / catch

try {
    grokProcessor.execute(doc);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("do not match field value")) {
        // route non-matching doc to alternate pipeline or failure store
    } else throw e;
}

Prevention

Maintain a library of representative sample logs and assert all patterns match them in tests.
Use trace_match to debug which patterns fire and which don't.
Plan for log format drift: add fallback patterns or route unmatched docs to a review pipeline.

When it happens

Trigger: A document's match field contains a string that does not conform to any of the configured patterns. E.g. pattern expects Apache log format but the value is JSON.

Common situations: Log format drift, multiple log sources feeding one pipeline, overly strict patterns, or wrong pattern selection. Common when onboarding a new log source without updating patterns.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/b0e82b2b1c1966f7. Report an issue: GitHub.

Appendix: source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/GrokProcessor.java:82

        this.validateOnly = validateOnly;
        // Joni warnings are only emitted on an attempt to match, and the warning emitted for every call to match which is too verbose
        // so here we emit a warning (if there is one) to the logfile at warn level on construction / processor creation.
        new Grok(patternBank, combinedPattern, matcherWatchdog, logger::warn).match("___nomatch___");
    }

    @Override
    public IngestDocument execute(IngestDocument ingestDocument) throws Exception {
        String fieldValue = ingestDocument.getFieldValue(matchField, String.class, ignoreMissing);

        if (fieldValue == null && ignoreMissing) {
            return ingestDocument;
        } else if (fieldValue == null) {
            throw new IllegalArgumentException("field [" + matchField + "] is null, cannot process it.");
        }

        Map<String, Object> matches = grok.captures(fieldValue);
        if (matches == null) {
            throw new IllegalArgumentException("Provided Grok expressions do not match field value: [" + fieldValue + "]");
        }

        if (!validateOnly) {
            matches.forEach(ingestDocument::setFieldValue);
        }

        if (traceMatch) {
            if (matchPatterns.size() > 1) {
                @SuppressWarnings("unchecked")
                HashMap<String, String> matchMap = (HashMap<String, String>) ingestDocument.getFieldValue(PATTERN_MATCH_KEY, Object.class);
                matchMap.keySet().stream().findFirst().ifPresent((index) -> { ingestDocument.setFieldValue(PATTERN_MATCH_KEY, index); });
            } else {
                ingestDocument.setFieldValue(PATTERN_MATCH_KEY, "0");
            }
        }
        return ingestDocument;
    }

View on GitHub (pinned to db6a809a66)