elastic/elasticsearch · error · IllegalArgumentException

Index [{}] name beginning with a dot (.) is not allowed

Error message

Index [{}] name beginning with a dot (.) is not allowed

What it means

IllegalArgumentException from the dot-prefix validator when creating an index whose name starts with '.' and the name is not whitelisted (not a system index, not in IGNORED_INDEX_NAMES, not matching validate_ignored_dot_patterns) — but only when running stateless. On non-stateless clusters the same input is a deprecation warning instead of an error. Dot-prefixed names are reserved for internal/system use.

Source

Thrown at modules/dot-prefix-validation/src/main/java/org/elasticsearch/validation/DotPrefixValidator.java:174

    void validateIndices(@Nullable Set<String> indices) {
        if (indices != null && isInternalRequest() == false) {
            for (String index : indices) {
                if (Strings.hasLength(index)) {
                    char c = getFirstChar(index);
                    if (c == '.') {
                        final String strippedName = stripDateMath(index);
                        if (IGNORED_INDEX_NAMES.contains(strippedName)) {
                            continue;
                        }
                        if (systemIndices.isSystemName(strippedName)) {
                            continue;
                        }
                        if (this.ignoredIndexPatterns.stream().anyMatch(p -> p.matcher(strippedName).matches())) {
                            continue;
                        }
                        if (isStateless) {
                            throw new IllegalArgumentException("Index [" + index + "] name beginning with a dot (.) is not allowed");
                        } else {
                            deprecationLogger.warn(
                                DeprecationCategory.INDICES,
                                "dot-prefix",
                                "Index [{}] name begins with a dot (.), which is deprecated, "
                                    + "and will not be allowed in a future Elasticsearch version.",
                                index
                            );
                        }
                    }
                }
            }
        }
    }

    private static char getFirstChar(String index) {
        char c = index.charAt(0);
        if (c == '<') {

View on GitHub (pinned to db6a809a66)

Solutions

1. Rename the index to remove the leading dot
2. If the name is legitimate internal tooling, register it as a system index via SystemIndices
3. Or add a matching regex to cluster.indices.validate_ignored_dot_patterns to exempt it

Example fix

// before (stateless)
PUT .myapp-logs-2025   // rejected
// after
PUT myapp-logs-2025    // no leading dot

// Reject dot-prefixed names before creating indices on stateless clusters:
if (isStateless && name.startsWith(".") && !isSystemName(name) && !matchesIgnored(name)) {
    throw new IllegalArgumentException("Index " + name + " name beginning with a dot is not allowed");
}

When it happens

Trigger: PUT /my-.index-name or any create-index / bulk-to-new-index request whose resolved name begins with '.' on a stateless cluster, where the name is not a registered system index or ignored pattern.

Common situations: Migrating legacy dashboards/clients that use dot-prefixed index names to a stateless deployment; tools that historically wrote to '.kibana'-style names; expecting old lenient behavior.

Related errors

• invalid deploymentTarget '{}', expected one of {}
• invalid dot validation exception pattern: [{}]
• Elasticsearch version is missing from properties.
• Expected elasticsearch version to be numbers only of the for
• Invalid qualifier: ${qualifier}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/bb29b7c10e5ad908. Report an issue: GitHub.