Field names cannot contain the . character in Elasticsearch 2.0

[cookandy]

Just to let you know, in Logstash 2.x field names cannot contain .

Until the template gets fixed, you can setup a filter on your logstash server to remove the periods

filter {
  ruby {
        code => "
          event.to_hash.keys.each { |k| event[ k.sub('.','_') ] = event.remove(k) if k.include?'.' }
        "
    }
}

See here https://discuss.elastic.co/t/field-name-cannot-contain/33251/11

[digital-wonderland]

Thanks a lot for the heads up. I opened elastic/elasticsearch#14594 to inquire if they intend to change that. If not I'll update the code to use / instead of ..

[wallies]

@digital-wonderland First off, awesome solution for logstash-forwarder. I still get this issue, the problem is when some containers are using things like com.amazonaws.ecs.container-name and works.weave.role as their labels. Should I use the filter above or could you handle it in code?

[cookandy]

I am also running into problems for some reason. Going to reopen this issue.