Field name cannot contain '.'

Elastic Stack Logstash
42

Yes it's just an example.
I tested your code to replace a field name starting winth dot but it doesn't work for second level (params..title)

43

For anyone looking into this here is the current state:

Best of luck!

2 Likes
44

OK, so question-from-ignorant me:

We're upgrading from 1.7 to 2.3. Some of our field names have dots in. What's the best way for us to migrate our data?

45

if your 1.7 index has _source enabled, de-dot filter helps you in replacing . in field names to _ or any other seperator. Once you run this utility 2.3 will be able to identify these indices.
if _source is disabled, there is no way to re-use the same indices, so have to discard the old ones and do indexing again

46

Is it available as an elasticsearch plugin? Or only with logstash?

47

Only with logstash

48

Hi!

Im also stucking with the "dot in a field problem"
I installed the de_dot plugin and activated it in the filter section:

filter {
  de_dot {
    nested => true
  }
}

The plugin itself seems working as I tested to add some fields with a successfully result.
But it seems that the dots in a field are not replaced, here is an example output:

{
   "kind" => "NodeList",
   "apiVersion" => "v1",
   "metadata" => {
        "selfLink" => "/api/v1/nodes",
        "resourceVersion" => "3890942"
    },
       "items" => [
        [0] {
            "metadata" => {
            "name" => "172.28.50.151",
            "selfLink" => "/api/v1/nodes/172.28.50.151",
            "uid" => "a2a40d8e-438e-11e6-befd-326261363032",
            "resourceVersion" => "3890934",
            "creationTimestamp" => "2016-07-06T15:30:57Z",
                    "labels" => {
                    "**beta.kubernetes.io**/arch" => "amd64",
                    "**beta.kubernetes.io**/os" => "linux",
                    "**kubernetes.io**/hostname" => "172.28.50.151"
                },
                    "annotations" => {
                    "volumes.kubernetes.io/controller-managed-attach-detach" => "true"
                }
            },
           "spec" => {

The json input string seems to be valid, I checked it with an online json parser, here is an extract from the input:

{
  "kind": "NodeList",
  "apiVersion": "v1",
  "metadata": {
    "selfLink": "/api/v1/nodes",
    "resourceVersion": "3886292"
  },
  "items": [
    {
      "metadata": {
        "name": "172.28.50.151",
        "selfLink": "/api/v1/nodes/172.28.50.151",
        "uid": "a2a40d8e-438e-11e6-befd-326261363032",
        "resourceVersion": "3886286",
        "creationTimestamp": "2016-07-06T15:30:57Z",
        "labels": {
          "**beta.kubernetes**.io/arch": "amd64",
          "**beta.kubernetes.io**/os": "linux",
          "kubernetes.io/hostname": "172.28.50.151"
        },
        "annotations": {
          "volumes.kubernetes.io/controller-managed-attach-detach": "true"
        }
      },
      "spec": {

This is the error message I get:
"reason"=>"Field name [volumes.kubernetes.io/controller-managed-attach-detach] cannot contain '.'"}}}, :level=>:warn}