provectus/kafka-ui · error · ValidationException

You can't provide both fieldNames & fieldsNamePattern for…

Error message

You can't provide both fieldNames & fieldsNamePattern for masking

What it means

FieldsSelector.create() builds the predicate that decides which fields a masking policy applies to. A policy may select fields either by an explicit list of names (fields) or by a regex (fieldsNamePattern), never both. When both are set in the ClustersProperties.Masking config, the selector cannot decide which rule wins, so it throws this ValidationException at startup/config time.

Solutions

Remove the `fields` list from the masking entry and keep only `fieldsNamePattern`
Or remove `fieldsNamePattern` and keep only the explicit `fields` list
Restart kafka-ui after correcting the config and confirm no validation error is logged

Example fix

// before
masking:
  fields: [password, ssn]
  fieldsNamePattern: ".*secret.*"
// after
masking:
  fieldsNamePattern: "(?i)(password|ssn|.*secret.*)"

Defensive patterns

Strategy: validation

Validate before calling

if (StringUtils.hasText(cfg.getFieldsNamePattern()) && !CollectionUtils.isEmpty(cfg.getFields())) {
  throw new IllegalArgumentException("Provide either fields or fieldsNamePattern, not both");
}

Type guard

boolean isMaskingSelectorValid(ClustersProperties.Masking m) {
  return StringUtils.hasText(m.getFieldsNamePattern()) ^ !CollectionUtils.isEmpty(m.getFields());
}

Prevention

Keep each masking entry to exactly one selection mechanism
Add a config linter or startup test asserting the XOR condition
Document in your helm values/schema which of the two keys wins

When it happens

Trigger: A kafka-ui clusters config defines a masking entry where both `fields` (non-empty list) and `fieldsNamePattern` (non-blank string) are populated; FieldsSelector.create() is then invoked when the masking policy is constructed.

Common situations: Copy-pasting an example masking config and adding a regex on top of existing field names; merging two partial masking configs; a Helm values overlay that appends fieldsNamePattern without removing fields.

Related errors

AI-assisted analysis of provectus/kafka-ui@83b5a60cc0 (2026-09-08). Data as JSON: /api/errors/4650e4a75ecf0b01. Report an issue: GitHub.

Appendix: source

Thrown at kafka-ui-api/src/main/java/com/provectus/kafka/ui/service/masking/policies/FieldsSelector.java:13

package com.provectus.kafka.ui.service.masking.policies;

import com.provectus.kafka.ui.config.ClustersProperties;
import com.provectus.kafka.ui.exception.ValidationException;
import java.util.regex.Pattern;
import org.springframework.util.CollectionUtils;
import org.springframework.util.StringUtils;

interface FieldsSelector {

  static FieldsSelector create(ClustersProperties.Masking property) {
    if (StringUtils.hasText(property.getFieldsNamePattern()) && !CollectionUtils.isEmpty(property.getFields())) {
      throw new ValidationException("You can't provide both fieldNames & fieldsNamePattern for masking");
    }
    if (StringUtils.hasText(property.getFieldsNamePattern())) {
      Pattern pattern = Pattern.compile(property.getFieldsNamePattern());
      return f -> pattern.matcher(f).matches();
    }
    if (!CollectionUtils.isEmpty(property.getFields())) {
      return f -> property.getFields().contains(f);
    }
    //no pattern, no field names - mean all fields should be masked
    return fieldName -> true;
  }

  boolean shouldBeMasked(String fieldName);

}

View on GitHub (pinned to 83b5a60cc0)