Thank you for your post and I apologize for the delayed response!
Error Data collection rule is invalid 'Name' field is not a valid column. It should start with a letter and then any combination of alphanumeric characters and '-' , '_'.
I understand that you're using the Logstash output plugin with Data Collection Rules (DCRs) within Microsoft Sentinel and are running into the above error message after creating a custom table and doing the transformation of
TimeGenerated. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.
Based off the error message that you're receiving it seems that the data collection rule you created is invalid. Please make sure that the name field within the JSON that you've provided for the DCR is valid and doesn't contain any special characters or spaces.
If you're still having issues and would like to work closer with our support team on this, please let me know. I'd be happy to enable a one-time free technical support request for your subscription so you can work with our support engineers to get this issue resolved.
I hope this helps!
If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.