Fleet Integration Custom Log File "1 Error" with No Context of the Error

Elastic Stack Elastic Agent
1

We ran into an issue where the Custom logs integration was at version 2.3.1 and apparently at some point you were able to use a dash (-) in the dataset name. You are not able to do this anymore as you can only use a period (.). This throws the error but there is no information as to what the error is referring too.

Our troubleshooting was to remove all of the file paths and that moved the error up to 2. We then added a file path back in and the errors went down to 1. There are no other indications as to what the error actually is and theres no way to add more file paths for the team we were working with because you can't update the integration.

2

We solved this by creating a new Custom logs integration running version 2.3.2 and moving all of the file paths over to that for harvesting as well as changing the dataset from project-testing to project.testing. Don't forget to edit any roles and Data views that users may have after this change.

This must be a legacy hangover where at some point you were able to use a dash in the namespace and dataset areas but now you are not.