What causes "Provided Grok expressions do not match field value: [{}]" in elastic/elasticsearch?

Add additional patterns that cover the unmatched log variant, or loosen existing patterns.

elastic/elasticsearch · error · IllegalArgumentException

Provided Grok expressions do not match field value: [{}]

Error message

Provided Grok expressions do not match field value: [{}]

What it means

Thrown by GrokProcessor.execute when grok.captures(fieldValue) returns null, meaning none of the configured grok patterns matched the input string. This is a data/pattern mismatch — the value is non-null but no pattern captures it. IllegalArgumentException so the document fails the processor and can route to the failure pipeline.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/GrokProcessor.java:82

        this.validateOnly = validateOnly;
        // Joni warnings are only emitted on an attempt to match, and the warning emitted for every call to match which is too verbose
        // so here we emit a warning (if there is one) to the logfile at warn level on construction / processor creation.
        new Grok(patternBank, combinedPattern, matcherWatchdog, logger::warn).match("___nomatch___");
    }

    @Override
    public IngestDocument execute(IngestDocument ingestDocument) throws Exception {
        String fieldValue = ingestDocument.getFieldValue(matchField, String.class, ignoreMissing);

        if (fieldValue == null && ignoreMissing) {
            return ingestDocument;
        } else if (fieldValue == null) {
            throw new IllegalArgumentException("field [" + matchField + "] is null, cannot process it.");
        }

        Map<String, Object> matches = grok.captures(fieldValue);
        if (matches == null) {
            throw new IllegalArgumentException("Provided Grok expressions do not match field value: [" + fieldValue + "]");
        }

        if (!validateOnly) {
            matches.forEach(ingestDocument::setFieldValue);
        }

        if (traceMatch) {
            if (matchPatterns.size() > 1) {
                @SuppressWarnings("unchecked")
                HashMap<String, String> matchMap = (HashMap<String, String>) ingestDocument.getFieldValue(PATTERN_MATCH_KEY, Object.class);
                matchMap.keySet().stream().findFirst().ifPresent((index) -> { ingestDocument.setFieldValue(PATTERN_MATCH_KEY, index); });
            } else {
                ingestDocument.setFieldValue(PATTERN_MATCH_KEY, "0");
            }
        }
        return ingestDocument;
    }

View on GitHub (pinned to db6a809a66)

Solutions

Add additional patterns that cover the unmatched log variant, or loosen existing patterns.
Use trace_match to identify which pattern (if any) is firing and debug non-matches.
Route non-matching documents to a different pipeline or to the failure store for separate handling.
Verify the pattern syntax against Grok debugger / Kibana Grok Debugger tool.

Example fix

// before
{"grok": {"field": "message", "patterns": ["%{COMBINEDAPACHELOG}"]}}
// after
{"grok": {"field": "message", "patterns": ["%{COMBINEDAPACHELOG}", "%{JSONLOG}"], "trace_match": true}}

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-test grok patterns against the value
Map<String,Object> test = grok.captures(sampleValue);
if (test == null) {
    // pattern doesn't match — broaden or route differently
}

Try / catch

try {
    grokProcessor.execute(doc);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("do not match field value")) {
        // route non-matching doc to alternate pipeline or failure store
    } else throw e;
}

Prevention

Maintain a library of representative sample logs and assert all patterns match them in tests.
Use trace_match to debug which patterns fire and which don't.
Plan for log format drift: add fallback patterns or route unmatched docs to a review pipeline.

When it happens

Trigger: A document's match field contains a string that does not conform to any of the configured patterns. E.g. pattern expects Apache log format but the value is JSON.

Common situations: Log format drift, multiple log sources feeding one pipeline, overly strict patterns, or wrong pattern selection. Common when onboarding a new log source without updating patterns.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/b0e82b2b1c1966f7. Report an issue: GitHub.