ES 2.1.2: Handling bad field names

In our elasticsearch environment we use dynamic mapping for log aggregation. However, we have some inbound logs with fields of the format "". Which generates an exception:

[2016-04-15 08:22:52,274][DEBUG][action.admin.indices.mapping.put] [es_master] failed to put mappings on indices [[logs-debug-2016.04.15]], type [service_core]
MapperParsingException[Field name [] cannot contain '.']

Can I allow for these poorly formatted field names by adding a mapping to my index template? If so, how do I do it?


If those logs come from logstash, I believe that you can use the de_dot filter.

The only way to do it in ES would be to use something like with a custom pattern.