Kv filter url parsing with dot inside field name

Elastic Stack Logstash
1

Hello,

I am parsing url, and i have warning message :
Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2015.10.07", :_type=>"apache-access", :_routing=>nil}, 2015-10-07T13:12:35.000Z XXX1-L00359 10.20.30.40 - - [07/Oct/2015:15:12:35 +0200] "GET /application.jsp?mx.page.filter=null&dir=central], :response=>{"create"=>{"_index"=>"logstash-2015.10.07", "_type"=>"apache-access", "_id"=>"AVSHFrEu4TEJdwWGtIsO", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Field name [mx.page.filter] cannot contain '.'"}}}, :level=>:warn}

To be able to create the field, Is there a way to replace the . dot by by an underscore _ or to remove this character ?

2

Just after your "kv" filter, I invite you to define "de_dot" filter :

de_dot {
}

It will rename automatically all fields containing ".", replacing "." by "_"

3

Thanks !