Invalid index name [_watcher], must not start with '_', '-', or '+'"

[mv007 (Maunil)]

Hello All,

I am a newbie in ELK and still learning it. I am planning to setup a watcher functionality.

Below is the watcher definition that i have written,

I have just followed the online document. However, I am not able to run this. It shows the below error

I followed similar post on this forum like : "reason": "Invalid index name [_watcher], must not start with '_'",

However, I could not able to crack the solution. I am looking forward to the suggestion on what is wrong here.

Thank you

Sincerely,
Maunil

[Yogesh_Gaikwad]

Hi @mv007,

Looks like the instead of Watcher endpoint being handled by the rest controller, it is trying to create the index named _watcher. This is failing as the ES does not allow index names to start with _.
By default the watcher is enabled and the service is started the request should be handled by rest controller but in your case the watcher seems to be disabled.

Could you please check if the watcher is enabled on your setup?
You can check it by using the x-pack info API
GET _xpack?categories=features&pretty

In the output you should see something like following:

"watcher" : {
      "available" : true,
      "enabled" : true
    }

if enabled: false then you will need to enable watcher by setting xpack.watcher.enabled.
Note that by default it would have been enabled.

Also, would be good to know what version of Elasticsearch you are using, elasticsearch.yml config file and logs if there are any errors.

Hope this helps.

Regards,
Yogesh Gaikwad

[dadoonet (David Pilato)]

I agree. My guess is that @mv007 did not install the standard version but another one like oss.

BTW @mv007 please don't post images of text as they are hard to read, may not display correctly for everyone, and are not searchable.

Instead, paste the text and format it with </> icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer.

[mv007 (Maunil)]

Thank you for your response and sorry for the late reply. You were right, the watcher was disabled and using your suggestions, I enabled them. It is working now

Thank you

[mv007 (Maunil)]

Thank you for your suggestion, and sorry for the late response. I will not post images.

Sincerely,
MV