Skip to content

Commit bcf268d

Browse files
committed
Update data streams documentation to note that sprintf syntax is not supported
Using sprintf syntax in the `data_streams` options is not supported. This commit adds a supplemental note, explaining this, and providing an example on how to dynamically route using `mutate` filter and the auto routing facility. Relates: elastic/logstash#17689
1 parent 7618e9b commit bcf268d

File tree

1 file changed

+16
-0
lines changed

1 file changed

+16
-0
lines changed

docs/index.asciidoc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,22 @@ output {
136136
}
137137
-----
138138

139+
NOTE: Dynamic variable substitution using sprintf syntax, such as %{foo}, is not supported in the `data_stream` options
140+
at this time. If you want to dynamically route to data streams, you can add the appropriate fields to events in
141+
the configuration and take advantage of the (on by default) auto routing facility:
142+
143+
[source,sh]
144+
-----
145+
filter {
146+
mutate {
147+
add_field => {
148+
"[data_stream][type]" => "logs"
149+
"[data_stream][dataset]" => "%{dataset_name}"
150+
"[data_stream][namespace]" => "%{namespace_name}"
151+
}
152+
}
153+
}
154+
-----
139155

140156
==== Writing to different indices: best practices
141157

0 commit comments

Comments
 (0)