Packetbeat invalid_index_name

Elastic Stack Beats
1

Hi,
I am trying to run packetbeat 5.0.1 in centos 6, while running I am getting the below error log
2016-11-25T13:20:01+09:00 WARN Can not index event (status=400): {"type":"invalid_index_name_exception","reason":"Invalid index name [packetbeat-2016.11.25.PM], must be lowercase","index_uuid":"na","index":"packetbeat-2016.11.25.PM"}
2016-11-25T13:20:01+09:00 WARN Can not index event (status=400): {"type":"invalid_index_name_exception","reason":"Invalid index name [packetbeat-2016.11.25.PM], must be lowercase","index_uuid":"na","index":"packetbeat-2016.11.25.PM"}
2016-11-25T13:20:01+09:00 WARN Can not index event (status=400): {"type":"invalid_index_name_exception","reason":"Invalid index name [packetbeat-2016.11.25.PM], must be lowercase","index_uuid":"na","index":"packetbeat-2016.11.25.PM"}
2016-11-25T13:20:01+09:00 WARN Can not index event (status=400): {"type":"invalid_index_name_exception","reason":"Invalid index name [packetbeat-2016.11.25.PM], must be lowercase","index_uuid":"na","index":"packetbeat-2016.11.25.PM"}

in my packetbeat.yml I have specified elasticsearch

output.elasticsearch:
index: "packetbeat-%{+yyyy.MM.dd.aa}"

I am not sure what I am doing, any idea?
Thank you!

2

As the error message says, index names must be lowercase. Apparently you can't use "aa" in index name patterns. Do you really need to split each day's index in two?

3

yes, It has to be separated for storage capacity

4

How big would a daily index be? Perhaps you can do hourly indexes?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.