Logstash, Could not index event to Elasticsearch

Elastic Stack Logstash
1

Hi,

I am trying to index some data with logstash. My config:

input {
	redis{
		host => "localhost"
		data_type => "list"
		key => "timeset1"
		threads => 4
	}
}

filter {
  date {
    match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS"]
	target => "@timestamp"
  }
}

output {
	stdout { codec => rubydebug }

	elasticsearch {
		hosts => ["IP:9200"]
		index => "timesTest"
	}
}

The problem is that it indexes some data but it also writes errors. When I stop logstash no index was created even tho logstash says that it transfered data.
Logstash output:

[2020-07-07T10:32:16,345][ERROR][logstash.outputs.elasticsearch][main][55b34dee464e7498728176c0eca68a8caa6e14e3bf9ecf126d1d3e5469cefbf8] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"timesTest", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x229bb276>], :response=>{"index"=>{"_index"=>"timesTest", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [timesTest], must be lowercase", "index_uuid"=>"_na_", "index"=>"timesTest"}}}}
{
             "line" => 10,
               "id" => 1591345304.7914,
           "cavity" => 62,
            "angle" => 2,
       "ignoreFail" => 0,
             "tags" => [
        [0] "_dateparsefailure"
    ],
         "insptime" => 2,
             "posy" => 15,
       "@timestamp" => 2020-07-07T08:32:11.196Z,
           "defect" => 0,
        "imagetype" => 3,
             "type" => "timeset1",
          "warning" => 0,
           "config" => 1,
             "posx" => 3,
         "camtrack" => 5,
             "tray" => 4,
          "setting" => 3,
       "created_at" => "1591345304.7914",
         "@version" => "1",
       "updated_at" => "1591345304.7914",
    "staticremoval" => 0,
        "timestamp" => "1591345304.7914"
}
{
             "line" => 6,
               "id" => 1591345304.6932,
           "cavity" => 36,
            "angle" => 2,
       "ignoreFail" => 0,
             "tags" => [
        [0] "_dateparsefailure"
    ],
         "insptime" => 2,
             "posy" => 6,
       "@timestamp" => 2020-07-07T08:32:11.196Z,
           "defect" => 10,
        "imagetype" => 3,
             "type" => "timeset1",
          "warning" => 0,
           "config" => 1,
             "posx" => 13,
         "camtrack" => 3,
             "tray" => 6,
          "setting" => 3,
       "created_at" => "1591345304.6932",
         "@version" => "1",
       "updated_at" => "1591345304.6932",
    "staticremoval" => 0,
        "timestamp" => "1591345304.6932"
}
[2020-07-07T10:32:16,347][ERROR][logstash.outputs.elasticsearch][main][55b34dee464e7498728176c0eca68a8caa6e14e3bf9ecf126d1d3e5469cefbf8] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"timesTest", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x6991fc46>], :response=>{"index"=>{"_index"=>"timesTest", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [timesTest], must be lowercase", "index_uuid"=>"_na_", "index"=>"timesTest"}}}}

How can I fix the Could not index event to Elasticsearch error and why does it not create a new index?

Thanks,
defalt

2

You stopped reading too early. The error message is pretty clear:

"reason"=>"Invalid index name [timesTest], must be lowercase"

3

I feel embaressed :grimacing:
Thank you

4

No problem :grin:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.