I have an index called this in kibana-
yellow open %[fields][log_type]-2020.01.09
and when I try to delete it with this command-
DELETE /%[fields][log_type]-2020.01.09
I get an error which says-
{
"error": "invalid escape sequence `%[f' at index 0 of: %[fields][log_type]-2020.01.09, allowed: [GET, PUT, DELETE, HEAD]",
"status": 405
}
Why am I not able to delete the indexes with %sign in front?
Hi @Mehak_Bhargava ,
% has a special meaning in URL/URI's and I think this is why this is failing. It is likely that it succeeds if you do:
DELETE /%25[fields][log_type]-2020.01.09
I am not sure if this is by design or not. If you want an answer to that I suggest to ask in the kibana forums .
This helped! Thanks, @HenningAndersen I think its important to have curly brackets after the '%' sign while creating the index in logstash which was my mistake. So for instance, this-
index => "%{[fields][log_type]}-%{+YYYY.MM.dd}"
@HenningAndersen , Hi again. I have an issue with the solution mentioned above. It worked at that time but now my index is called
%{[fields][tag]}
and it isnt deleting at all. I added the curly bracket as discussed before but now facing similar issue. Please let me know root cause.
Hi @Mehak_Bhargava ,
you should be able to delete the index if you escape the special characters. Something like:
DELETE /%25%7b%5bfields%5d%5btag%5d%7d
You can read more on the percent-encoding in rfc 3986 .
If you seek help on how to setup logstash correctly, I suggest to address that part of the question to the logstash forum .
system
(system)
Closed
February 23, 2020, 8:02pm
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.