6.4.1 invalid_index_name_exception

Elastic Stack Logstash
1

Hello!

I'm newbie, just installed logstash 6.4.1 and see errors in log like:

[2018-10-05T11:45:49,445][ERROR][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"asamts,3-2018.10.05", :_type=>"doc", :_routing=>ni
l}, #LogStash::Event:0x24298b3c], :response=>{"index"=>{"_index"=>"asamts,3-2018.10.05", "_type"=>"doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index na
me [asamts,3-2018.10.05], must not contain the following characters [ , ", *, \, <, |, ,, >, /, ?]", "index_uuid"=>"na", "index"=>"asamts,3-2018.10.05"}}}}

I can't understand how is it possible.
I have in output:

    elasticsearch {
    #  index => "%{type}-%{+YYYY.MM.dd}"
      index => "asamts-%{+YYYY.MM.dd}"
    }

I.e. it can't contain this ,3

Could you tell me how is it possible?

Thank you!

2

Perhaps you have another configuration file with an elasticsearch output that's configured differently? Keep in mind that Logstash loads all your .conf files in the directory. You can easily check this by commenting out the elasticsearch output above and see what happens.

3

Really, no.
I moved this log to rsyslogd and looks like it works now without problems and with far lower cpu usage.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.