Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

ElasticSearch 2.0 doesn't allow '.' in field names

See original GitHub issue

See https://github.com/elastic/elasticsearch/issues/14594. This means there’s no way we can use @fields. in AccessEvent anymore: https://github.com/logstash/logstash-logback-encoder#standard-fields-1

Issue Analytics

State:
Created 8 years ago
Comments:10 (1 by maintainers)

Top GitHub Comments

2reactions

harbulotcommented, Mar 7, 2016

@edudar It doesn’t treat them as hierarchical fields by default. You’d get this sort of error:

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Field name [@fields.HOSTNAME] cannot contain '.'"}}}

There is a discussion on the topic here: https://discuss.elastic.co/t/field-name-cannot-contain/33251/32

A possible workaround is to use the logstash-filter-de_dot plugin, and a configuration like this:

filter {
  de_dot {
    nested => true
  }
}

0reactions

philsttrcommented, Feb 19, 2018

Dots have been removed from default access event field names in 5.0 (not released yet)

Top Results From Across the Web

ElasticSearch 2.0 doesn't allow '.' in field names #138 - GitHub

I have a bunch of fieldnames with "." in them and would like a generic solution, like rewriting such fields to camelCase or...

[term] query does not support different field names, use [bool ...

I am currently using ElasticSearch v2.3.2 and am having an issue ... query does not support different field names, use [bool] query instead....

Spaces in field names? - Kibana - Discuss the Elastic Stack

I'd appreciate a definitive answer from the Elastic Team about the support for spaces in field names in (a) Kibana and (b) Elasticsearch....

Retrieve selected fields from a search | Elasticsearch Guide [8.5]

By default, the fields parameter returns only values of mapped fields. However, Elasticsearch allows storing fields in _source that are unmapped, such as ......

Accessing document fields and special variables - Elastic

The _source is loaded as a map-of-maps, so properties within object fields can be accessed as, for example, _source.name.first .