elastic/elasticsearch · error · IllegalArgumentException

invalid data stream name: [{}]; must follow naming scheme <t

Error message

invalid data stream name: [{}]; must follow naming scheme <type>-<dataset>-<namespace>

What it means

Thrown by RerouteProcessor.execute when the current _index value contains no dash at all, so it cannot be parsed as a <type>-<dataset>-<namespace> data stream name. The processor requires at least two dashes to split the three components.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/RerouteProcessor.java:89

        }
        this.destination = destination;
    }

    @Override
    public IngestDocument execute(IngestDocument ingestDocument) throws Exception {
        if (destination != null) {
            ingestDocument.reroute(destination);
            return ingestDocument;
        }
        final String indexName = ingestDocument.getFieldValue(IngestDocument.Metadata.INDEX.getFieldName(), String.class);
        final String currentType;
        final String currentDataset;
        final String currentNamespace;

        // parse out the <type>-<dataset>-<namespace> components from _index
        int indexOfFirstDash = indexName.indexOf('-');
        if (indexOfFirstDash < 0) {
            throw new IllegalArgumentException(format(NAMING_SCHEME_ERROR_MESSAGE, indexName));
        }
        int indexOfSecondDash = indexName.indexOf('-', indexOfFirstDash + 1);
        if (indexOfSecondDash < 0) {
            throw new IllegalArgumentException(format(NAMING_SCHEME_ERROR_MESSAGE, indexName));
        }
        currentType = parseDataStreamType(indexName, indexOfFirstDash);
        currentDataset = parseDataStreamDataset(indexName, indexOfFirstDash, indexOfSecondDash);
        currentNamespace = parseDataStreamNamespace(indexName, indexOfSecondDash);

        String type = determineDataStreamField(ingestDocument, this.type, currentType);
        String dataset = determineDataStreamField(ingestDocument, this.dataset, currentDataset);
        String namespace = determineDataStreamField(ingestDocument, this.namespace, currentNamespace);
        String newTarget = type + "-" + dataset + "-" + namespace;
        ingestDocument.reroute(newTarget);
        setFieldValue(ingestDocument, DATA_STREAM_TYPE, type);
        setFieldValue(ingestDocument, DATA_STREAM_DATASET, dataset);
        setFieldValue(ingestDocument, DATA_STREAM_NAMESPACE, namespace);
        if (ingestDocument.getCtxMap().containsKey(EVENT_DATASET) || ingestDocument.hasField(EVENT_DATASET)) {

View on GitHub (pinned to db6a809a66)

Solutions

1. Provide an explicit destination in the processor config so it skips data-stream-name parsing.
2. Ensure the document is actually part of a data stream before using reroute without a destination.
3. Switch to a data stream naming convention (<type>-<dataset>-<namespace>) for the target index.

Example fix

// before
{
  "reroute": { }
}
// after (explicit destination avoids parsing)
{
  "reroute": { "destination": "logs-myapp-prod" }
}

// Validate _index has at least two dashes before reroute without destination
String idx = document.getFieldValue("_index", String.class);
if (idx == null || idx.indexOf('-') < 0) {
    // set an explicit destination or route to a data stream
}

boolean looksLikeDataStreamName(String idx) {
    if (idx == null) return false;
    int first = idx.indexOf('-');
    return first > 0 && idx.indexOf('-', first + 1) > first;
}

try {
    // run reroute without destination
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("invalid data stream name")) {
        // provide a destination or ensure _index is a data stream name
    } else { throw e; }
}

When it happens

Trigger: Running the reroute processor (without an explicit destination) on a document whose _index metadata is a plain index name with no dashes, e.g. 'myindex'. indexOfFirstDash returns -1 and the exception fires.

Common situations: Pointing the reroute processor at documents indexed into a regular index rather than a data stream. Using reroute without a destination on non-data-stream indices. Misconfigured pipelines migrated from a data-stream context to a regular index.

Related errors

• '{}' is not a valid field reference
• '{}' contains disallowed characters
• field [{}] of type [{}] cannot be cast to [{}]
• failure store document has unexpected structure, missing req
• failure store document has unexpected structure, missing req

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/906ebd3debd0cdaa. Report an issue: GitHub.