# Logstash filter - error

**URL:** <https://discuss.elastic.co/t/logstash-filter-error/162665>\
**Category:** Logstash\
**Created:** [January 2, 2019, 2:12pm UTC](https://discuss.elastic.co/t/logstash-filter-error/162665 "2019-01-02T14:12:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ravi\_Khurana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ravi_khurana/32/39357_2.png) [@Ravi\_Khurana](https://discuss.elastic.co/u/Ravi_Khurana)\
**Post date:** [January 2, 2019, 2:12pm UTC](https://discuss.elastic.co/t/logstash-filter-error/162665/1 "2019-01-02T14:12:09Z")

</div>

Hi team, i am new on ELK stack, and i was trying to read log (given below) through filter, kindly help to write the filter on the below log,

2018-08-25 14:14:29,026 [http-nio-8085-exec-458] INFO com..cdb.utils.Utils - getHTTPClientResponse -sUrl : [https://vender:443/v1/services/url?lineOfBusiness=Mobility](https://vender:443/v1/services/url?lineOfBusiness=Mobility)

2018-08-25 14:14:29,026 [http-nio-8085-exec-458] INFO com..cdb.utils.Utils - getHTTPClientResponse -Service IP Address : 10.0.0.1  
2018-08-25 14:14:29,027 [http-nio-8085-exec-458] INFO com..cdb.utils.Utils - getHTTPClientResponse -Service Port (https): 443

2018-08-25 14:14:29,027 [http-nio-8085-exec-458] INFO com..cdb.utils.Utils - getHTTPClientResponse -Final URL: [https://vender:443/v1/services/url?lineOfBusiness=Mobility](https://vender:443/v1/services/url?lineOfBusiness=Mobility)

2018-08-25 14:14:29,061 [http-nio-8085-exec-458] INFO com..cdb.utils.Utils - getHTTPClientResponse -Total time consumed after execute Method34

2018-08-25 14:14:29,061 [http-nio-8085-exec-458] INFO com..cdb.responsetype.CDBMobilityResponse - loadObject -

2018-08-25 14:14:29,061 [http-nio-8085-exec-458] INFO com..cdb.responsetype.CDBMobilityResponse - loadObject -HTTPStatus Code from third Party-\> 200

the filter which i was running is below

* * *

input {  
file  
{  
path =\> "/opt/logstash-6.5.4/data/CDBOptimus.log"  
start\_position =\> "beginning"  
}  
}

# The filter part of this file is commented out to indicate that it is

# optional.

filter {  
date {  
match =\> ["logdate", "YYYY-MM-dd HH:mm:ss,SSS"]  
target =\> "logdate"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "CDB-Optimus"  
}  
}

and the error which i got is (in logstash log)

**[2019-01-02T05:43:27,643][ERROR][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"CDB-Optimus", :\_type=\>"doc", :routing=\>nil}, #LogStash::Event:0x19aef96a], :response=\>{"index"=\>{"\_index"=\>"CDB-Optimus", "\_type"=\>"doc", "\_id"=\>nil, "status"=\>400, "error"=\>{"type"=\>"invalid\_index\_name\_exception", "reason"=\>"Invalid index name [CDB-Optimus], must be lowercase", "index\_uuid"=\>"_na_", "index"=\>"CDB-Optimus"}}}}**

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [January 3, 2019, 3:09pm UTC](https://discuss.elastic.co/t/logstash-filter-error/162665/2 "2019-01-03T15:09:01Z")

</div>

> [@Ravi\_Khurana](#):
>
> Invalid index name [CDB-Optimus], must be lowercase

The error message indicates you are using upper case letters in your index name, that is not allowed. Fix that first and then use the grok filter to generate a pattern that matches your log lines.

---

<div class="post-metadata">

**Author:** ![Ravi\_Khurana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ravi_khurana/32/39357_2.png) [@Ravi\_Khurana](https://discuss.elastic.co/u/Ravi_Khurana)\
**Post date:** [January 9, 2019, 1:04pm UTC](https://discuss.elastic.co/t/logstash-filter-error/162665/3 "2019-01-09T13:04:45Z")

</div>

thanks after making them in lower case, i got the exact error and i got the filter created based on the above log, thanks Andreas!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2019, 1:04pm UTC](https://discuss.elastic.co/t/logstash-filter-error/162665/4 "2019-02-06T13:04:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.