Invalid Index Name Exception

Hello everyone,

I have an issue when I try to make an index a field created using add_field by referencing them when outputing. I create three .conf files that begin by a number , like 1file.conf, 2file.conf and 99output.conf, this in order the output file be the last file to compile. In the first 2 files, I create the field by using the same name, for example, I add_field => { "indexname" => "field_reference1" }

Here i my output file:

output {
        elasticsearch {
                hosts => [""]
                index => "%{[indexname]}"

I'm getting an invalid index name exception with the error below:

response=>{"index"=>{"_index"=>"field_reference1,field_reference2", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [field_reference1,field_reference2], must not contain the following characters ['\\','/','*','?','\"','<','>','|',' ',',']", "index_uuid"=>"_na_", "index"=>"field_reference1,field_reference2"}}}}

I don't know what I'm missing. Please help.
Thanks a lot in advance.

You need to share your configurations because it is not possible to understand what is happening.

But from your error, it means that the field indexname has a comma (,) in it, which is not allowed.

From what you shared, the index name you are trying to create is this field_reference1,field_reference2, which will not work because of the comma.

I suspect you are unconditionally doing both the

add_field => { "indexname" => "field_reference1" }


add_field => { "indexname" => "field_reference2" }

for the same events. In that case indexname will be an array and if the logstash calls .to_s to convert that to a string (which the index option has to be) then it will end up with comma separated names, causing elasticsearch to throw that exception.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.