ES 2.1.2: Handling bad field names

Elastic Stack Elasticsearch
1

Hi,
In our elasticsearch environment we use dynamic mapping for log aggregation. However, we have some inbound logs with fields of the format "field.name". Which generates an exception:

[2016-04-15 08:22:52,274][DEBUG][action.admin.indices.mapping.put] [es_master] failed to put mappings on indices [[logs-debug-2016.04.15]], type [service_core]
MapperParsingException[Field name [field.name] cannot contain '.']

Can I allow for these poorly formatted field names by adding a mapping to my index template? If so, how do I do it?

Regards,
David

2

If those logs come from logstash, I believe that you can use the de_dot filter.

3

The only way to do it in ES would be to use something like https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-pattern-tokenizer.html with a custom pattern.