elastic/elasticsearch · error · IllegalArgumentException

'{}' contains disallowed characters

Error message

'{}' contains disallowed characters

What it means

Thrown in the DataStreamValueSource constructor when the value is a static string (no field-reference markers) but fails sanitization via DataStream.sanitizeType/Dataset/Namespace. This means the static value contains characters not allowed in data stream name segments.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/RerouteProcessor.java:265

                if (value.startsWith("{{") == false || value.endsWith("}}") == false) {
                    throw new IllegalArgumentException("'" + value + "' is not a valid field reference");
                }
                String fieldReference = value.substring(2, value.length() - 2);
                // field references may have two or three curly braces
                if (fieldReference.startsWith("{") && fieldReference.endsWith("}")) {
                    fieldReference = fieldReference.substring(1, fieldReference.length() - 1);
                }
                fieldReference = fieldReference.trim();
                // only a single field reference is allowed
                // so something like this is disallowed: {{foo}}-{{bar}}
                if (fieldReference.contains("{") || fieldReference.contains("}")) {
                    throw new IllegalArgumentException("'" + value + "' is not a valid field reference");
                }
                this.fieldReference = fieldReference;
            } else {
                this.fieldReference = null;
                if (Objects.equals(sanitizer.apply(value), value) == false) {
                    throw new IllegalArgumentException("'" + value + "' contains disallowed characters");
                }
            }
        }

        /**
         * Resolves the field reference from the provided ingest document or returns the static value if this value source doesn't represent
         * a field reference.
         * @param ingestDocument
         * @return the resolved field reference or static value
         */
        @Nullable
        public String resolve(IngestDocument ingestDocument) {
            if (fieldReference != null) {
                String value = ingestDocument.getFieldValue(fieldReference, String.class, true);
                if (value == null) {
                    value = getStringFieldValueInDottedNotation(ingestDocument);
                }
                return sanitizer.apply(value);

View on GitHub (pinned to db6a809a66)

Solutions

1. Use only lowercase alphanumeric characters, hyphens, underscores, and dots as required by data stream naming.
2. Run the value through the appropriate DataStream.sanitize* method before setting it.
3. Rename static values to comply with the <type>-<dataset>-<namespace> rules (lowercase, no invalid punctuation).

Example fix

// before
{
  "reroute": { "dataset": "My App Logs" }
}
// after
{
  "reroute": { "dataset": "my_app_logs" }
}

// Validate static data-stream segment values pass sanitization
String value = "my_dataset"; // example
String sanitized = DataStream.sanitizeDataset(value);
if (!sanitized.equals(value)) {
    throw new IllegalArgumentException("value contains disallowed characters: " + value);
}

boolean isValidStaticSegment(String value) {
    if (value == null) return false;
    // data stream names: lowercase, alphanumeric, hyphens, underscores, dots
    return value.matches("^[a-z0-9][a-z0-9._-]*[a-z0-9]$") || value.matches("^[a-z0-9]$");
}

try {
    // build reroute processor with static value
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("contains disallowed characters")) {
        // sanitize or rename the static value to lowercase alphanumerics
    } else { throw e; }
}

When it happens

Trigger: Configuring reroute with a static type/dataset/namespace containing invalid characters such as uppercase letters, spaces, commas, colons, or other disallowed symbols for data stream names.

Common situations: Using mixed-case or special characters in dataset names (e.g., 'My App Logs'). Including spaces, slashes, or punctuation that data stream naming rules reject.

Related errors

• invalid data stream name: [{}]; must follow naming scheme <t
• '{}' is not a valid field reference
• field [{}] of type [{}] cannot be cast to [{}]
• failure store document has unexpected structure, missing req
• failure store document has unexpected structure, missing req

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/7dcc60e1c16d5e81. Report an issue: GitHub.