# Invalid\_index\_name\_exception with variable name **URL:** \ **Category:** Logstash\ **Created:** [June 26, 2018, 1:23pm UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435 "2018-06-26T13:23:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![amas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amas/32/32697_2.png) [@amas](https://discuss.elastic.co/u/amas)\ **Post date:** [June 26, 2018, 1:23pm UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435/1 "2018-06-26T13:23:04Z")
I'm getting these warnings with the 6.3.0 stack: [2018-06-26T12:45:22,619][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-%{Environment}-2018.06.26", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x54432d92], :response=\>{"index"=\>{"\_index"=\>"logstash-%{Environment}-2018.06.26", "\_type"=\>"doc", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"invalid\_index\_name\_exception", "reason"=\>"Invalid index name [logstash-%{Environment}-2018.06.26], must be lowercase", "index\_uuid"=\>"_na_", "index"=\>"logstash-%{Environment}-2018.06.26"}}}} in the input fields i have: add\_field =\> { "Environment" =\> "production" } and the output is: index =\> "logstash-%{Environment}-%{+YYYY.MM.dd}" The error goes away when i change the "variable name" to environment instead of Environment. I understand that the index name cannot be uppercase, but should the variablename also be affected by this? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 26, 2018, 6:16pm UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435/2 "2018-06-26T18:16:07Z")
The event didn't actually contain an `Environment` field. ---
**Author:** ![amas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amas/32/32697_2.png) [@amas](https://discuss.elastic.co/u/amas)\ **Post date:** [June 27, 2018, 8:56am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435/3 "2018-06-27T08:56:01Z")
> [@magnusbaeck](#): > > actually @magnusbaeck That's very strange. Since i only use logstash to pull data from AWS Cloudwatch logs and populate it with the add\_field =\> { "environment" =\> "production" }. Why would it matter if i change the E from capital to lowercase. If i change the environment to Environment i get the error. And it stops when i switch it back to environment. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 27, 2018, 10:14am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435/4 "2018-06-27T10:14:28Z")
> That's very strange. Since i only use logstash to pull data from AWS Cloudwatch logs and populate it with the add\_field =\> { "environment" =\> "production" }. Why would it matter if i change the E from capital to lowercase. Does your configuration contain ``` add_field => { "environment" => "production" } ``` or ``` add_field => { "Environment" => "production" } ``` ? Field names are case-sensitive so make sure you spell the field name identically everywhere. ---
**Author:** ![amas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amas/32/32697_2.png) [@amas](https://discuss.elastic.co/u/amas)\ **Post date:** [June 27, 2018, 11:30am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435/5 "2018-06-27T11:30:32Z")
@magnusbaeck Ok i don't know if i were unclear. But i've been running this config on 5.6.x without issues. The configuration was then: `add_field => { "Environment" => "production" }` This gave me errors on 6.3.0 (as mentioned in the first post) I just simply renamed `Environment` to `environment` in all my `cloudwatch_logs` statements and in the output statement, and everything now works without warnings ---
**Author:** ![amas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amas/32/32697_2.png) [@amas](https://discuss.elastic.co/u/amas)\ **Post date:** [June 28, 2018, 11:58am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435/6 "2018-06-28T11:58:48Z")
Figured out what what caused all this. I've been using the elapsed plugin, and it turns out that if there is a timeout it will create a new event that didn't have the %{Environment} variable set, thus trying to create a new index. when i changed the Environment variable to lowercase it created the index with the name `logstash-%{environment}-2018.06.28` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2018, 11:58am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435/7 "2018-07-26T11:58:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.