# Getting 'Badly formatted index, after interpolation still contains placeholder' error when trying to ingest AWS WAF logs

**URL:** https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862
**Category:** Logstash
**Created:** [August 16, 2023, 2:14am UTC](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862 "2023-08-16T02:14:14Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![feo13](https://avatars.discourse-cdn.com/v4/letter/f/bc8723/32.png) [@feo13](https://discuss.elastic.co/u/feo13)
#### Post date: [August 16, 2023, 2:14am UTC](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862/1 "2023-08-16T02:14:15Z")

</div>

Hi there,

I'm trying to ingest AWS WAF logs with logstash-8.9.0 and send them to my local ELK stack but am getting a 'Badly formatted index, after interpolation still contains placeholder' error. Here's my logstash config:

```auto
input { 
  s3 { 
    "access_key_id" => "foo"
    "secret_access_key" => "bar"
    "region" => "us-east-1" 
    "bucket" => "aws-waf-logs" 
    "type" => "waf-log" 
    "interval" => "300" 
    "sincedb_path" => "/tmp/.waf-log_since.db" 
  } 
} 

filter { 
  if [type] == "waf-log" { 
   json { 
        source => "message" 
  } 
  date { 
        match => ["[timestamp]", "UNIX_MS" ] 
  } 
  geoip { 
        source => ["[httpRequest][clientIp]" ] 
        target => geoip 
  } 
  ruby { 
    code => ' 
      event.get("[httpRequest][headers]").each { |kv| 
        event.set(name = kv["name"], value = kv["value"])} 
        ' 
  } 
} 
} 

output { 
  elasticsearch { 
    hosts => ["http://127.0.0.1:9200/"] 
    index => "%{[type]}%-{+YYYY.MM.dd}"
    ilm_enabled => false 
    data_stream => false
    action => "create"
  } 
}

```

I read [Could not index event to Elasticsearch DataStream](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-datastream/302722) but changing index to 'index =\> "%{[@metadata][beat]}-%{[@metadata][version]}"' returns the same 'Badly formatted index' error.

Can anyone point me in the right direction?

Thanks!

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 16, 2023, 3:04am UTC](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862/2 "2023-08-16T03:04:08Z")

</div>

Hi @feo13 Welcome to the community.

> [@feo13](#):
>
> ` index => "%{[type]}%-{+YYYY.MM.dd}"`

Look like at least a Syntax error got an `%` in the wrong place

` index => "%{[type]}-%{+YYYY.MM.dd}"`  
`...................^`

---

<div class="post-metadata">

### Author: ![feo13](https://avatars.discourse-cdn.com/v4/letter/f/bc8723/32.png) [@feo13](https://discuss.elastic.co/u/feo13)
#### Post date: [August 16, 2023, 3:59am UTC](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862/3 "2023-08-16T03:59:06Z")

</div>

Thank you SO much! It looks like that resolved the 'Badly formatted index' error but now I'm getting this:

```auto
[2023-08-16T03:42:25,231][WARN][logstash.outputs.elasticsearch][main]
[ca2bc6153105dde6379bf39666d95cd4b608ad24418e29aca41368c5e05372ef] Could 
not index event to Elasticsearch. {:status=>400, :action=>["create", 
{:_id=>nil, :_index=>"waf-log-2023.05.12", :routing=>nil}, 
{"terminatingRuleType"=>"REGULAR", "@timestamp"=>2023-05-12T18:43:26.325Z,

```

From what I've read, that can happen when there's an old index template and the mappings aren't aligned. But when I go into Dev Console and do a 'GET \_template', I just see '.monitoring-es' so I'm not sure what exactly to delete.

Thanks again for your response -- I really appreciate it!

---

<div class="post-metadata">

### Author: ![feo13](https://avatars.discourse-cdn.com/v4/letter/f/bc8723/32.png) [@feo13](https://discuss.elastic.co/u/feo13)
#### Post date: [August 16, 2023, 4:38am UTC](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862/4 "2023-08-16T04:38:19Z")

</div>

OK, I got it. I just deleted all pre-existing indicies and index templates that I'd created for WAF, restarted logstash, and recreated the template.

Thank you again for the help -- I really appreciate it!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2023, 4:38am UTC](https://discuss.elastic.co/t/getting-badly-formatted-index-after-interpolation-still-contains-placeholder-error-when-trying-to-ingest-aws-waf-logs/340862/5 "2023-09-13T04:38:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.