Logstash Configuration throwing 400

Elastic Stack Logstash
1

I am new to ELK stack and trying the below configuration and i've mentioned the exception as well please suggest :slight_smile:

input {
file {
type => "java"
path => "C:\data\Logs_20180720\eis_log_file.log"
start_position => "beginning"
codec => plain {
charset => "ISO-8859-1"
}
sincedb_path => "/dev/null"

}
}

filter {

grok {
match => [ 'message','%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level}\s*%{JAVACLASS:class}.%{WORD:method} %{NUMBER:timeTakenForExecution:"\d+"}\s*-\s*%{GREEDYDATA:log}',
'exception_message','%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level}\s*%{JAVACLASS:class}.: %{JAVACLASS:exception}.',
'message','%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level}\s*%{JAVACLASS:class}.*: %{GREEDYDATA:log}'

]
}

}

output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-EIS-%{+YYYY.MM}"
}
}

[2018-07-23T17:51:00,517][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-EIS-2018.07", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x1f621f48], :response=>{"index"=>{"_index"=>"logstash-EIS-2018.07", "_type"=>"doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [logstash-EIS-2018.07], must be lowercase", "index_uuid"=>"na", "index"=>"logstash-EIS-2018.07"}}}}

2

I think the error message is quite clear...

3

thank you

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.