Must not start with – How to solve this Elasticsearch exception

Opster Team

August-23, Version: 6.8-8.9

Briefly, this error occurs when an Elasticsearch index, alias, or field name starts with an underscore (‘_’). Elasticsearch reserves names starting with underscores for internal operations. To resolve this issue, rename the index, alias, or field without leading underscore. If the error is due to a field name in your data, you may need to preprocess your data to rename the field. Alternatively, you can use a script or ingest node to rename the field during indexing.

This guide will help you check for common problems that cause the log ” must not start with ‘_’. ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: metadata, cluster.

Log Context

Log “must not start with ‘_’.” class name is We extracted the following from Elasticsearch source code for those seeking an in-depth context :

 // Expressions can not start with an underscore. This is reserved for APIs. If the check gets here; the API
 // does not exist and the path is interpreted as an expression. If the expression begins with an underscore;
 // throw a specific error that is different from the [[IndexNotFoundException]]; which is typically thrown
 // if the expression can't be found.
 if (expression.expression().charAt(0) == '_') {
 throw new InvalidIndexNameException(expression.expression(); "must not start with '_'.");
 }  private static void ensureRemoteIndicesRequireIgnoreUnavailable(IndicesOptions options; List indexExpressions) {
 if (options.ignoreUnavailable() == false) {