From 2e5d8f66a48afb3d33a2d59bd52f74b0aba1ab73 Mon Sep 17 00:00:00 2001 From: Rob Bavey Date: Mon, 15 Sep 2025 11:25:08 -0400 Subject: [PATCH 1/2] Update data streams documentation to note that sprintf syntax is not supported Using sprintf syntax in the `data_streams` options is not supported. This commit adds a supplemental note, explaining this, and providing an example on how to dynamically route using `mutate` filter and the auto routing facility. Relates: https://github.com/elastic/logstash/issues/17689 --- docs/index.asciidoc | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/index.asciidoc b/docs/index.asciidoc index 3611c04b..744492a5 100644 --- a/docs/index.asciidoc +++ b/docs/index.asciidoc @@ -136,6 +136,22 @@ output { } ----- +NOTE: Dynamic variable substitution using sprintf syntax, such as %{foo}, is not supported in the `data_stream` options + at this time. If you want to dynamically route to data streams, you can add the appropriate fields to events in + the configuration and take advantage of the (on by default) auto routing facility: + +[source,sh] +----- +filter { + mutate { + add_field => { + "[data_stream][type]" => "logs" + "[data_stream][dataset]" => "%{dataset_name}" + "[data_stream][namespace]" => "%{namespace_name}" + } + } +} +----- ==== Writing to different indices: best practices From 6e76b3977e1d3a5b0eee7d004d768ac2ef06120d Mon Sep 17 00:00:00 2001 From: Rob Bavey Date: Fri, 24 Oct 2025 16:02:40 -0400 Subject: [PATCH 2/2] Add changelog, update version --- CHANGELOG.md | 3 +++ logstash-output-elasticsearch.gemspec | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 14d59640..52845415 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +## 12.1.1 + - Update documentation to state that that sprintf syntax is not supported for datastreams, and give a workaround [#1224](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/1224) + ## 12.1.0 - Add drop_error_types config option to not retry after certain error types [#1228](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/1228) diff --git a/logstash-output-elasticsearch.gemspec b/logstash-output-elasticsearch.gemspec index f884bdeb..31e82ac1 100644 --- a/logstash-output-elasticsearch.gemspec +++ b/logstash-output-elasticsearch.gemspec @@ -1,6 +1,6 @@ Gem::Specification.new do |s| s.name = 'logstash-output-elasticsearch' - s.version = '12.1.0' + s.version = '12.1.1' s.licenses = ['apache-2.0'] s.summary = "Stores logs in Elasticsearch" s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"