Field Name Cannot Contain '.'

[ryanmaclean]

Can this be revisited for the Elastic Stack release? I realize that this is intentional, but perhaps making this an option in ES (IIRC nested tags are the problem) is the best way around the root cause which forced the change in Logstash.

The problem currently is that our dashboards are already set up in many locations and many installs and switching to '_' from '.' is not only untennable, but also is not JSON standard: http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-404.pdf (see page 3)

I realize that breaking the standard was done for a good reason on the ES side, but adding load to Logstash in order to mutate this via a ruby script (as per https://discuss.elastic.co/t/field-name-cannot-contain/33251/22) is simply adding insult to injury.

If I've understood this wrong, please correct me.

[jordansissel]

JSON isn't the problem, so I don't think we need to discuss the JSON specification :)

We are actively working to figure out how to make dots available again for field names in Elasticsearch over in this ticket.

[ryanmaclean]

This is fantastic news, thanks!

[suyograo]

Since this is covered in elastic/elasticsearch#15951 will close this. To automatically convert dots to _, you also have the option of using de_dot filter logstash-filter-de_dot

[ryanmaclean]

@suyograo both this ticket and that one are closed without resolutions.

[suyograo]

@ryanmaclean this is better tracked in Elasticsearch via elastic/elasticsearch#15951. Logstash will allow dots as long as ES will allow it. Meanwhile, you can also use this de_dot filter https://www.elastic.co/blog/introducing-the-de_dot-filter as a workaround