# Invalid FieldReference: \`\_Domain\_Labels\[0\]\_ULabel\`

**URL:** https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016
**Category:** Logstash
**Created:** [June 27, 2023, 5:43pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016 "2023-06-27T17:43:34Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![tcapp24](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@tcapp24](https://discuss.elastic.co/u/tcapp24)
#### Post date: [June 27, 2023, 5:43pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016/1 "2023-06-27T17:43:35Z")

</div>

Logstash version - 7.17.8

Currently we are seeing invalid FieldReference errors on our Logstash nodes dealing with \_Domain\_Labels[0]\_ULabel

```auto
onf.d/mulesoft/get_cloudhub_app_logs.conf"], :thread=>"#<Thread:0x1475cac0 run>"}
warning: thread "Ruby-0-Thread-71: :1" terminated with exception (report_on_exception is true):
org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `_Domain_Labels[0]_ULabel`
        at org.logstash.FieldReference$StrictTokenizer.tokenize(FieldReference.java:321)
        at org.logstash.FieldReference.parse(FieldReference.java:222)
        at org.logstash.FieldReference.parseToCache(FieldReference.java:213)
        at org.logstash.FieldReference.from(FieldReference.java:136)
        at org.logstash.FieldReference.from(FieldReference.java:122)
        at org.logstash.ConvertedMap.convertKey(ConvertedMap.java:121)
        at org.logstash.ConvertedMap.access$000(ConvertedMap.java:43)
        at org.logstash.ConvertedMap$1.visit(ConvertedMap.java:54)
        at org.logstash.ConvertedMap$1.visit(ConvertedMap.java:48)
        at org.jruby.RubyHash.visitLimited(RubyHash.java:698)
        at org.jruby.RubyHash.visitAll(RubyHash.java:683)
        at org.logstash.ConvertedMap.newFromRubyHash(ConvertedMap.java:88)
        at org.logstash.ext.JrubyEventExtLibrary$RubyEvent.ruby_initialize(JrubyEventExtLibrary.java:97)
        at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$parse$0(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:253)
        at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$new_event$0(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:226)
        at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$udp_listener$0(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:206)
        at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$udp_listener$0$ __VARARGS__ (/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:180)
        at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)
        at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)
        at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)
        at usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$block$run$2(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:79)
        at org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)
        at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)
        at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)
        at org.jruby.runtime.Block.call(Block.java:139)
        at org.jruby.RubyProc.call(RubyProc.java:318)
        at org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)
        at java.base/java.lang.Thread.run(Thread.java:829)
[2023-06-27T14:12:43,361][FATAL][logstash.runner] An unexpected error occurred! {:error=>org.logstash.FieldReference$IllegalSyntaxException: Invalid FieldReference: `_Domain_Labels[0]_ULabel`, :backtrace=>["org.logstash.FieldReference$StrictTokenizer.tokenize(FieldReference.java:321)", "org.logstash.FieldReference.parse(FieldReference.java:222)", "org.logstash.FieldReference.parseToCache(FieldReference.java:213)", "org.logstash.FieldReference.from(FieldReference.java:136)", "org.logstash.FieldReference.from(FieldReference.java:122)", "org.logstash.ConvertedMap.convertKey(ConvertedMap.java:121)", "org.logstash.ConvertedMap.access$000(ConvertedMap.java:43)", "org.logstash.ConvertedMap$1.visit(ConvertedMap.java:54)", "org.logstash.ConvertedMap$1.visit(ConvertedMap.java:48)", "org.jruby.RubyHash.visitLimited(RubyHash.java:698)", "org.jruby.RubyHash.visitAll(RubyHash.java:683)", "org.logstash.ConvertedMap.newFromRubyHash(ConvertedMap.java:88)", "org.logstash.ext.JrubyEventExtLibrary$RubyEvent.ruby_initialize(JrubyEventExtLibrary.java:97)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$parse$0(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:253)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$new_event$0(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:226)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$udp_listener$0(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:206)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$method$udp_listener$0$ __VARARGS__ (/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:180)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:80)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:70)", "org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:207)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_input_minus_gelf_minus_3_dot_3_dot_2.lib.logstash.inputs.gelf.RUBY$block$run$2(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-gelf-3.3.2/lib/logstash/inputs/gelf.rb:79)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:138)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:52)", "org.jruby.runtime.Block.call(Block.java:139)", "org.jruby.RubyProc.call(RubyProc.java:318)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105)", "java.base/java.lang.Thread.run(Thread.java:829)"]}
[2023-06-27T14:12:43,476][INFO][logstash.javapipeline][beats] Pipeline Java execution initialization time {"seconds"=>2.26}
[2023-06-27T14:12:43,505][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?]
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?]
        at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]

```

I have tried adding in our Logstash config the mutator below but still get errors after restarting logstash:

```auto
mutate {
        rename => { "_Domain_Labels[0]_ULabel " => "%{[Domain_Labels[0]_ULabel]}"}
    }

```

Is there a way to mutate \_Domain\_Labels[0]\_ULabel to fix the invalid FieldReference error?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 27, 2023, 7:49pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016/2 "2023-06-27T19:49:43Z")

</div>

By the time a field with that name is created it may already be too late to fix it. How is it getting created?

---

<div class="post-metadata">

### Author: ![tcapp24](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@tcapp24](https://discuss.elastic.co/u/tcapp24)
#### Post date: [June 27, 2023, 8:06pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016/3 "2023-06-27T20:06:19Z")

</div>

> [@Badger](#):
>
> By the time a field with that name is created it may already be too late to fix it. How is it getting created?

Its getting created via another project we have that turns it into \_Domain\_Labels\_0\_ULabel. So I think your right its probably too late to fix using mutate, and we probably have to find the source and change config there.

---

<div class="post-metadata">

### Author: ![Sunile\_Manjee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunile_manjee/32/111461_2.png) [@Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)
#### Post date: [June 30, 2023, 3:25am UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016/4 "2023-06-30T03:25:44Z")

</div>

personally curious. Do you mind providing a sample doc?

---

<div class="post-metadata">

### Author: ![tcapp24](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@tcapp24](https://discuss.elastic.co/u/tcapp24)
#### Post date: [July 11, 2023, 3:40pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016/5 "2023-07-11T15:40:05Z")

</div>

@Badger Is there a way to ignore invalid fieldreference errors?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 11, 2023, 3:50pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016/6 "2023-07-11T15:50:13Z")

</div>

> [@tcapp24](#):
>
> Is there a way to ignore invalid fieldreference errors?

I think that only if you do not try to mutate the field, if you try to mutate you will get this error.

I don't think you can fix this in Logstash, you need to fix this before sending the data to Logstash.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 8, 2023, 3:51pm UTC](https://discuss.elastic.co/t/invalid-fieldreference-domain-labels-0-ulabel/337016/7 "2023-08-08T15:51:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.