Octavio Melendres

Seems like an issue with the new elasticsearch rules on field name characters. Will try to make some tests changing the template. Thanks

Seems the issue is related to the field name _id. It is ok to rename it to just id.

There ase some errors with elasticsearch. Looks like the script is doing some search on an index not created yet ``` /node_modules/log-ship-elastic-postfix# node server.js { Error: ENOENT: no such file...

Couple of issues worth to mention: The code searches for field 'id', which is also described on the template file, but the record example references to field 'qid'. Looks like...

Don't know much about arrays on ES, haven't used them. How about the id search?

Thanks I'll post the results

Another test, Elasticsearch throws an error on query string generated by nodejs path: '/postfix-orphan-2017-07-05%2Cpostfix-2017-07-05/_search' Index not found {"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"postfix-2017-07-05","index_uuid":"_na_","index":"postfix-2017-07-05"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"postfix-2017-07-05","index_uuid":"_na_","index":"postfix-2017-07-05"},"status":404}