Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
I tried different versions of logstash (8.4,0, 8.6.1,8.9.0) , but none of them is working.
but same working fine for logstash version 7.16.0
log shows
[ERROR][logstash.outputs.opensearch][my-pipeline_1][7f3703f59724b8ff34625f6f6af5e8515045256d0d72eab56c34ecb036f34d29] Could not index event to OpenSearch. {:status=>400, :action=>[“index”, {:_id=>nil, :_index=>“auditlogs-%{[yearEvent]}”, :routing=>nil}, {“log”=>{“file”=>{“path”=>“/abc/xyz.log”}}, “@timestamp”=>2023-10-18T11:39:45.955052093Z, “browser”=>“Firefox”, “username”=>“0==administrator”, “tenantID”=>“0”, “client”=>“...”, “weblink”=>“/api/account/login”, “@version”=>“1”, “user”=>“administrator”, “method”=>“POST”, “logtime”=>“14:39:45”, “jsondata”=>“{"LoginName":"administrator","Password":"","status":"success"}|", “event”=>{“original”=>"14:39:45|...|Firefox|administrator|POST|/api/account/login|{"LoginName":"administrator","Password":"****","status":"success"}|”}}], :response=>{“index”=>{“_index”=>“auditlogs-%{[yearEvent]}”, “_id”=>nil, “status”=>400, “error”=>{“type”=>“invalid_index_name_exception”, “reason”=>“Invalid index name [auditlogs-%{[yearEvent]}], must be lowercase”, “index”=>“auditlogs-%{[yearEvent]}”, “index_uuid”=>“na”}}}}
apart from this in documentation of openSearch it show
“docker pull opensearchproject/logstash-oss-with-opensearch-output-plugin:7.16.2” even for opensearch version 2.11.0
is it just the example?
