What causes "Value is not a valid timestamp: {}" in elastic/elasticsearch?

Confirm the producer's exact timestamp format and align it with the TIME_FORMAT expected by the parser (MMddyyyy HH:mm:ss.SSS or epoch ms).

elastic/elasticsearch · error · IllegalArgumentException

Value is not a valid timestamp: {}

Error message

Value is not a valid timestamp: {}

What it means

CefParser.toTimestamp could not interpret the value either as epoch milliseconds (pure digits) or via the configured TIME_FORMAT DateTimeFormatter. Thrown as IllegalArgumentException when a CEF extension mapped to DataType.TimestampType (e.g. 'rt', 'end', 'start', 'art') has a value matching neither shape. The original DateTimeParseException is swallowed.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java:555

            // if there is no year nor year-of-era, we fall back to the current one and
            // fill the rest of the date up with the parsed date
            if (accessor.isSupported(ChronoField.YEAR) == false
                && accessor.isSupported(ChronoField.YEAR_OF_ERA) == false
                && accessor.isSupported(WeekFields.ISO.weekBasedYear()) == false
                && accessor.isSupported(WeekFields.of(Locale.ROOT).weekBasedYear()) == false
                && accessor.isSupported(ChronoField.INSTANT_SECONDS) == false) {
                int year = LocalDate.now(ZoneOffset.UTC).getYear();
                ZonedDateTime newTime = Instant.EPOCH.atZone(ZoneOffset.UTC).withYear(year);
                for (ChronoField field : CHRONO_FIELDS) {
                    if (accessor.isSupported(field)) {
                        newTime = newTime.with(field, accessor.get(field));
                    }
                }
                accessor = newTime.withZoneSameLocal(timezone);
            }
            return DateFormatters.from(accessor, Locale.ROOT, timezone).withZoneSameInstant(timezone);
        } catch (DateTimeParseException ignored) {
            throw new IllegalArgumentException("Value is not a valid timestamp: " + value);
        }
    }

    // visible for testing
    String toMACAddress(String v) throws IllegalArgumentException {
        // Insert separators if necessary
        String macWithSeparators = insertMACSeparators(v);
        // Validate MAC address format
        Matcher matcher = MAC_ADDRESS_PATTERN.matcher(macWithSeparators);
        if (matcher.matches() == false) {
            throw new IllegalArgumentException("Invalid MAC address format");
        }
        return macWithSeparators;
    }

    // visible for testing
    String toIP(String v) {
        try {

View on GitHub (pinned to db6a809a66)

Solutions

Confirm the producer's exact timestamp format and align it with the TIME_FORMAT expected by the parser (MMddyyyy HH:mm:ss.SSS or epoch ms).
If the value is epoch-seconds, multiply by 1000 upstream so the parser sees milliseconds.
Pre-format the timestamp with a date processor set to the producer's format before routing to cef, or override the field to StringType so no parse is attempted.
Use on_failure to quarantine events with unparseable timestamps.

Example fix

// before — value uses a format the parser does not recognize
//   field: 'CEF:0|v|p|1.0|1|n|3|rt=2024-06-01T12:00:00Z next=...'
//
// after — emit epoch ms or the parser's expected layout
//   field: 'CEF:0|v|p|1.0|1|n|3|rt=Jun 01 2024 12:00:00.000 next=...'
//   or:   '...|rt=1717233600000 next=...'

Defensive patterns

Strategy: validation

Validate before calling

// Accept epoch-ms (digits only) or the strict CEF timestamp layout; reject everything else early.
private static final Pattern CEF_TS = Pattern.compile("^\\d+$|" +
    "^[A-Z][a-z]{2} \\d{2} \\d{4} \\d{2}:\\d{2}:\\d{2}(\\.\\d{3})?$");
boolean isAcceptableTimestamp(String v) {
    return v != null && CEF_TS.matcher(v).matches();
}

Try / catch

{
  "on_failure": [
    { "set": { "field": "ingest.error", "value": "cef-bad-timestamp" } },
    { "redirect": { "pipeline": "quarantine" } }
  ]
}

Prevention

Confirm the producer's timestamp format matches TIME_FORMAT or epoch-ms before enabling the cef processor.
If you cannot change the producer, use a date processor upstream to normalize the value first.
For epoch-seconds, multiply by 1000 before the cef processor sees the value.

When it happens

Trigger: Calling CefProcessor on an event whose timestamp-typed extension carries a value like '2024/06/01 12:00:00', 'Jun 1 2024', 'today', or any locale/format that does not match the strict TIME_FORMAT. An epoch value in seconds (not ms) — e.g. '1717200000' — is parsed as ms and silently shifted but does NOT throw; only a fully unparseable value throws.

Common situations: Producer changes date format without notice; non-English locale month names; AM/PM markers missing; sub-second precision with an unexpected separator; test fixtures with hand-typed dates.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/57bee0d9f947e62c. Report an issue: GitHub.