Elasticsearch sql query does not work when index name contains "-"

Elastic Stack Elasticsearch
#1

I've been playing with elasticsearch sql query and I have tried to run DESCRIBE filebeat-6.5.0-2019.01.04 but I am getting the following error:

{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "line 1:18: mismatched input '-' expecting <EOF>"
      }
    ],
    "type": "parsing_exception",
    "reason": "line 1:18: mismatched input '-' expecting <EOF>",
    "caused_by": {
      "type": "input_mismatch_exception",
      "reason": null
    }
  },
  "status": 400
}

It seam that the sql query does not support '-' in index name.

#2

Found a workaround by createting an alias for the index and using that alias in the query.

#3

SQL treats - as a minus operation, which doesn't makes sense in this particular context. So, in order to use the index as is, you can simply put it in quotes:

DESCRIBE "filebeat-6.5.0-2019.01.04"

#4

Tried that and did not worked.

#5

Where did you try it?

#6

I might have done something wrong. I just tried that with escaped double quotes and it worked. Thank you for the information.

1 Like
#7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.