# Logstash, Could not index event to Elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123>\
**Category:** Logstash\
**Created:** [July 7, 2020, 8:45am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123 "2020-07-07T08:45:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![defalt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defalt/32/71379_2.png) [@defalt](https://discuss.elastic.co/u/defalt)\
**Post date:** [July 7, 2020, 8:45am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123/1 "2020-07-07T08:45:02Z")

</div>

Hi,

I am trying to index some data with logstash. My config:

```auto
input {
	redis{
		host => "localhost"
		data_type => "list"
		key => "timeset1"
		threads => 4
	}
}

filter {
  date {
    match => ["timestamp" , "yyyy-MM-dd HH:mm:ss.SSS"]
	target => "@timestamp"
  }
}

output {
	stdout { codec => rubydebug }

	elasticsearch {
		hosts => ["IP:9200"]
		index => "timesTest"
	}
}

```

The problem is that it indexes some data but it also writes errors. When I stop logstash no index was created even tho logstash says that it transfered data.  
Logstash output:

```auto
[2020-07-07T10:32:16,345][ERROR][logstash.outputs.elasticsearch][main][55b34dee464e7498728176c0eca68a8caa6e14e3bf9ecf126d1d3e5469cefbf8] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"timesTest", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x229bb276>], :response=>{"index"=>{"_index"=>"timesTest", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [timesTest], must be lowercase", "index_uuid"=>"_na_", "index"=>"timesTest"}}}}
{
             "line" => 10,
               "id" => 1591345304.7914,
           "cavity" => 62,
            "angle" => 2,
       "ignoreFail" => 0,
             "tags" => [
        [0] "_dateparsefailure"
    ],
         "insptime" => 2,
             "posy" => 15,
       "@timestamp" => 2020-07-07T08:32:11.196Z,
           "defect" => 0,
        "imagetype" => 3,
             "type" => "timeset1",
          "warning" => 0,
           "config" => 1,
             "posx" => 3,
         "camtrack" => 5,
             "tray" => 4,
          "setting" => 3,
       "created_at" => "1591345304.7914",
         "@version" => "1",
       "updated_at" => "1591345304.7914",
    "staticremoval" => 0,
        "timestamp" => "1591345304.7914"
}
{
             "line" => 6,
               "id" => 1591345304.6932,
           "cavity" => 36,
            "angle" => 2,
       "ignoreFail" => 0,
             "tags" => [
        [0] "_dateparsefailure"
    ],
         "insptime" => 2,
             "posy" => 6,
       "@timestamp" => 2020-07-07T08:32:11.196Z,
           "defect" => 10,
        "imagetype" => 3,
             "type" => "timeset1",
          "warning" => 0,
           "config" => 1,
             "posx" => 13,
         "camtrack" => 3,
             "tray" => 6,
          "setting" => 3,
       "created_at" => "1591345304.6932",
         "@version" => "1",
       "updated_at" => "1591345304.6932",
    "staticremoval" => 0,
        "timestamp" => "1591345304.6932"
}
[2020-07-07T10:32:16,347][ERROR][logstash.outputs.elasticsearch][main][55b34dee464e7498728176c0eca68a8caa6e14e3bf9ecf126d1d3e5469cefbf8] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"timesTest", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x6991fc46>], :response=>{"index"=>{"_index"=>"timesTest", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"invalid_index_name_exception", "reason"=>"Invalid index name [timesTest], must be lowercase", "index_uuid"=>"_na_", "index"=>"timesTest"}}}}

```

How can I fix the `Could not index event to Elasticsearch` error and why does it not create a new index?

Thanks,  
_defalt_

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 7, 2020, 9:09am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123/2 "2020-07-07T09:09:51Z")

</div>

You stopped reading too early. The error message is pretty clear:

> "reason"=\>"Invalid index name [timesTest], must be lowercase"

---

<div class="post-metadata">

**Author:** ![defalt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defalt/32/71379_2.png) [@defalt](https://discuss.elastic.co/u/defalt)\
**Post date:** [July 7, 2020, 9:13am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123/3 "2020-07-07T09:13:01Z")

</div>

I feel embaressed 😬  
Thank you

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 7, 2020, 9:23am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123/4 "2020-07-07T09:23:05Z")

</div>

No problem 😁

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2020, 9:23am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123/5 "2020-08-04T09:23:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.