Elasticsearch sql query does not work when index name contains "-"

I've been playing with elasticsearch sql query and I have tried to run DESCRIBE filebeat-6.5.0-2019.01.04 but I am getting the following error:

  "error": {
    "root_cause": [
        "type": "parsing_exception",
        "reason": "line 1:18: mismatched input '-' expecting <EOF>"
    "type": "parsing_exception",
    "reason": "line 1:18: mismatched input '-' expecting <EOF>",
    "caused_by": {
      "type": "input_mismatch_exception",
      "reason": null
  "status": 400

It seam that the sql query does not support '-' in index name.

Found a workaround by createting an alias for the index and using that alias in the query.

SQL treats - as a minus operation, which doesn't makes sense in this particular context. So, in order to use the index as is, you can simply put it in quotes:

DESCRIBE "filebeat-6.5.0-2019.01.04"

Tried that and did not worked.

Where did you try it?

I might have done something wrong. I just tried that with escaped double quotes and it worked. Thank you for the information.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.