elastic/elasticsearch · error · IllegalArgumentException

unable to set domain information for document

Error message

unable to set domain information for document

What it means

Thrown by RegisteredDomainProcessor.execute when parsing the FQDN fails to extract registered domain information and ignoreMissing is false. The processor uses a public suffix list to determine the registered domain, subdomain, top-level domain, etc., and throws if the input cannot be parsed.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/RegisteredDomainProcessor.java:60

    }

    public boolean getIgnoreMissing() {
        return ignoreMissing;
    }

    @Override
    public IngestDocument execute(IngestDocument document) throws Exception {
        final String fqdn = document.getFieldValue(field, String.class, ignoreMissing);
        String fieldPrefix = targetField;
        if (fieldPrefix.isEmpty() == false) {
            fieldPrefix += ".";
        }
        boolean infoFound = RegisteredDomain.parseRegisteredDomainInfo(
            fqdn,
            new IngestDocumentRegisteredDomainInfoCollector(document, fieldPrefix)
        );
        if (infoFound == false && ignoreMissing == false) {
            throw new IllegalArgumentException("unable to set domain information for document");
        }
        return document;
    }

    @Override
    public String getType() {
        return TYPE;
    }

    public static final class Factory implements Processor.Factory {

        static final String DEFAULT_TARGET_FIELD = "";

        @Override
        public RegisteredDomainProcessor create(
            Map<String, Processor.Factory> registry,
            String tag,
            String description,

View on GitHub (pinned to db6a809a66)

Solutions

1. Set ignore_missing: true in the processor config to skip unparseable values instead of failing.
2. Pre-filter documents so only valid FQDNs reach this processor (e.g., via a conditional script).
3. Verify the source field actually contains hostname strings and not IPs or free text.

Example fix

// before
{
  "registered_domain": { "field": "host" }
}
// after
{
  "registered_domain": { "field": "host", "ignore_missing": true }
}

// Validate the field is a hostname-like string before registered_domain
Object val = document.getFieldValue("fqdn", Object.class, true);
if (val == null || (val instanceof String s && s.matches("^[A-Za-z0-9.-]+$") == false)) {
    // skip or set ignore_missing: true
}

boolean isParseableHostname(String s) {
    return s != null && !s.isBlank() && s.matches("^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$") && s.contains(".");
}

try {
    // run registered_domain processor
} catch (IllegalArgumentException e) {
    if (e.getMessage().equals("unable to set domain information for document")) {
        // set ignore_missing: true in config, or route to a fallback
    } else { throw e; }
}

When it happens

Trigger: Configuring the registered_domain processor on a field whose value is not a parseable hostname (e.g., an IP address, a bare TLD, an empty string, or malformed input), with ignore_missing set to false (the default).

Common situations: Pointing the processor at a field containing IP addresses instead of hostnames. Feeding internal hostnames without a public suffix. Data quality issues where the field contains free text or nulls.

Related errors

• failure store document has unexpected structure, missing req
• failure store document has unexpected structure, missing req
• field [{}] doesn't exist
• field [{}] already exists
• invalid data stream name: [{}]; must follow naming scheme <t

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/a7e8757ad9eba128. Report an issue: GitHub.