# Logstash Configuration throwing 400

**URL:** <https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173>\
**Category:** Logstash\
**Created:** [July 23, 2018, 12:27pm UTC](https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173 "2018-07-23T12:27:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [July 23, 2018, 12:27pm UTC](https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173/1 "2018-07-23T12:27:20Z")

</div>

I am new to ELK stack and trying the below configuration and i've mentioned the exception as well please suggest 🙂

> input {  
> file {  
> type =\> "java"  
> path =\> "C:\data\Logs\_20180720\eis\_log\_file.log"  
> start\_position =\> "beginning"  
> codec =\> plain {  
> charset =\> "ISO-8859-1"  
> }  
> sincedb\_path =\> "/dev/null"
> 
> }  
> }
> 
> filter {
> 
> grok {  
> match =\> [ 'message','%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:level}\s\*%{JAVACLASS:class}.%{WORD:method} %{NUMBER:timeTakenForExecution:"\d+"}\s\*-\s\*%{GREEDYDATA:log}',  
> 'exception\_message','%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:level}\s\*%{JAVACLASS:class}._: %{JAVACLASS:exception}._',  
> 'message','%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:level}\s\*%{JAVACLASS:class}.\*: %{GREEDYDATA:log}'
> 
> ]  
> }
> 
> }
> 
> output {  
> stdout {  
> codec =\> rubydebug  
> }  
> elasticsearch {  
> hosts =\> ["localhost:9200"]  
> index =\> "logstash-EIS-%{+YYYY.MM}"  
> }  
> }

> [2018-07-23T17:51:00,517][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-EIS-2018.07", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x1f621f48], :response=\>{"index"=\>{"\_index"=\>"logstash-EIS-2018.07", "\_type"=\>"doc", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"invalid\_index\_name\_exception", "reason"=\>"Invalid index name [logstash-EIS-2018.07], must be lowercase", "index\_uuid"=\>"_na_", "index"=\>"logstash-EIS-2018.07"}}}}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 23, 2018, 12:29pm UTC](https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173/2 "2018-07-23T12:29:55Z")

</div>

> [@Raghuveer\_SJ](#):
>
> "Invalid index name [logstash-EIS-2018.07], must be lowercase"

I think the error message is quite clear...

---

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [July 23, 2018, 12:34pm UTC](https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173/3 "2018-07-23T12:34:32Z")

</div>

thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2018, 12:34pm UTC](https://discuss.elastic.co/t/logstash-configuration-throwing-400/141173/4 "2018-08-20T12:34:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.