How to delete index? Invalid escape sequence `%[f' at index 0 of: %[fields][log_type]-2020.01.09

Elastic Stack Elasticsearch
1

I have an index called this in kibana-

yellow open   %[fields][log_type]-2020.01.09

and when I try to delete it with this command-

DELETE /%[fields][log_type]-2020.01.09

I get an error which says-

{
  "error": "invalid escape sequence `%[f' at index 0 of: %[fields][log_type]-2020.01.09, allowed: [GET, PUT, DELETE, HEAD]",
  "status": 405
}

Why am I not able to delete the indexes with %sign in front?

2

Hi @Mehak_Bhargava,

% has a special meaning in URL/URI's and I think this is why this is failing. It is likely that it succeeds if you do:

DELETE /%25[fields][log_type]-2020.01.09

I am not sure if this is by design or not. If you want an answer to that I suggest to ask in the kibana forums.

3

This helped! Thanks, @HenningAndersen I think its important to have curly brackets after the '%' sign while creating the index in logstash which was my mistake. So for instance, this-

index    => "%{[fields][log_type]}-%{+YYYY.MM.dd}"
4

@HenningAndersen, Hi again. I have an issue with the solution mentioned above. It worked at that time but now my index is called

 %{[fields][tag]}

and it isnt deleting at all. I added the curly bracket as discussed before but now facing similar issue. Please let me know root cause.

5

Hi @Mehak_Bhargava,

you should be able to delete the index if you escape the special characters. Something like:

DELETE /%25%7b%5bfields%5d%5btag%5d%7d

You can read more on the percent-encoding in rfc 3986.

If you seek help on how to setup logstash correctly, I suggest to address that part of the question to the logstash forum.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.