Index patterns are not supported in doc level monitors

Plugins Alerting
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser)

Opensearch 3.3.0

Describe the issue:

When creating a “per document monitor”, it’s not possible to specify a data stream or index that contains a dot in its name.

Failed to run the query
[alerting_exception] Index patterns are not supported in doc level monitors.

When I select an index without a dot, it works fine.

Relevant Logs or Screenshots:

When entering an index containing a dot

[2025-11-19T13:57:18,230][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [tb-opensearch004] uncaught exception in thread [DefaultDispatcher-worker-1]
org.opensearch.commons.alerting.util.AlertingException: Failed fetching index stats
at org.opensearch.commons.alerting.util.AlertingException$Companion.wrap(AlertingException.kt:70) ~[common-utils-3.3.0.0.jar:?]
at org.opensearch.alerting.MonitorMetadataService.getOrCreateMetadata(MonitorMetadataService.kt:162) ~[opensearch-alerting-3.3.0.0.jar:3.3.0.0]
at org.opensearch.alerting.MonitorMetadataService$getOrCreateMetadata$1.invokeSuspend(MonitorMetadataService.kt) ~[opensearch-alerting-3.3.0.0.jar:3.3.0.0]
at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.9.25.jar:1.9.25-release-852]
at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:285) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) [kotlinx-coroutines-core-1.1.1.jar:?]
Suppressed: org.opensearch.commons.alerting.util.AlertingException: Failed fetching index stats
at org.opensearch.commons.alerting.util.AlertingException$Companion.wrap(AlertingException.kt:70) ~[common-utils-3.3.0.0.jar:?]
at org.opensearch.alerting.MonitorMetadataService.getOrCreateMetadata(MonitorMetadataService.kt:162) ~[opensearch-alerting-3.3.0.0.jar:3.3.0.0]
at org.opensearch.alerting.MonitorMetadataService$getOrCreateMetadata$1.invokeSuspend(MonitorMetadataService.kt) ~[opensearch-alerting-3.3.0.0.jar:3.3.0.0]
at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.9.25.jar:1.9.25-release-852]
at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:285) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) [kotlinx-coroutines-core-1.1.1.jar:?]
Suppressed: org.opensearch.commons.alerting.util.AlertingException: Failed fetching index stats
at org.opensearch.commons.alerting.util.AlertingException$Companion.wrap(AlertingException.kt:70) ~[common-utils-3.3.0.0.jar:?]
at org.opensearch.alerting.MonitorMetadataService.getOrCreateMetadata(MonitorMetadataService.kt:162) ~[opensearch-alerting-3.3.0.0.jar:3.3.0.0]
at org.opensearch.alerting.MonitorMetadataService$getOrCreateMetadata$1.invokeSuspend(MonitorMetadataService.kt) ~[opensearch-alerting-3.3.0.0.jar:3.3.0.0]
at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.9.25.jar:1.9.25-release-852]
at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:285) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) [kotlinx-coroutines-core-1.1.1.jar:?]
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) [kotlinx-coroutines-core-1.1.1.jar:?]
Caused by: java.lang.Exception: org.opensearch.commons.alerting.util.AlertingException: Failed fetching index stats
… 8 more
Caused by: java.lang.Exception: org.opensearch.commons.alerting.util.AlertingException: Failed fetching index stats
… 8 more
Caused by: java.lang.Exception: org.opensearch.commons.alerting.util.AlertingException: Failed fetching index stats
… 8 more

Problem when creating a detection rule
2

@gstorme Why would you use a dot in the index name? Very often, this is treated as a special character and requires escaping.

3

We will switch from dots to underscores in our index names.

But if dots are a problem for certain plugins, maybe it should be added to the naming restriction for indexes on Managing indexes - OpenSearch Documentation

4

@gstorme OpenSearch allows creating and using index names with a dot.
The issue refers to the Alerting plugin that doesn’t handle them well.

My suggestion is more of a good practice advice.

You can create an issue in the OpenSearch Alerting plugin GitHub.

If you do so, please share the link here.

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.