i think that was the problem.
now i'm trying to lowercase and remove whitespaces from the report_name field
mutate {
add_field => { "index_report_name" => "%{report_name}" }
lowercase => [ "index_report_name" ]
gsub => [
#remove all whitespaces
"index_report_name", " ", ""
]
}
but that still not working
[2017-04-25T16:43:02,678][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"nessus-report-VA vsware-2017.04.25", :_type=>"nessus-report", :_routing=>nil}, 2017-04-25T19:41:54.197Z CSB-OdinProxy %{message}], :response=>{"index"=>{"_index"=>"nessus-report-VA vsware-2017.04.25", "_type"=>"nessus-report", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [nessus-report-VA vsware-2017.04.25], must not contain the following characters [ , \", *, \\, <, |, ,, >, /, ?]", "index_uuid"=>"_na_", "index"=>"nessus-report-VA vsware-2017.04.25"}}}}