Invalid Index Name Exception

Elastic Stack Logstash
1

Hello everyone,

I have an issue when I try to make an index a field created using add_field by referencing them when outputing. I create three .conf files that begin by a number , like 1file.conf, 2file.conf and 99output.conf, this in order the output file be the last file to compile. In the first 2 files, I create the field by using the same name, for example, I add_field => { "indexname" => "field_reference1" }

Here i my output file:

output {
        elasticsearch {
                hosts => ["https://10.173.86.15:9200"]
                ...
                index => "%{[indexname]}"
        }
}

I'm getting an invalid index name exception with the error below:

response=>{"index"=>{"_index"=>"field_reference1,field_reference2", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [field_reference1,field_reference2], must not contain the following characters ['\\','/','*','?','\"','<','>','|',' ',',']", "index_uuid"=>"_na_", "index"=>"field_reference1,field_reference2"}}}}

I don't know what I'm missing. Please help.
Thanks a lot in advance.

2

You need to share your configurations because it is not possible to understand what is happening.

But from your error, it means that the field indexname has a comma (,) in it, which is not allowed.

From what you shared, the index name you are trying to create is this field_reference1,field_reference2, which will not work because of the comma.

3

I suspect you are unconditionally doing both the

add_field => { "indexname" => "field_reference1" }

and

add_field => { "indexname" => "field_reference2" }

for the same events. In that case indexname will be an array and if the logstash calls .to_s to convert that to a string (which the index option has to be) then it will end up with comma separated names, causing elasticsearch to throw that exception.