Badly formatted index, after interpolation still contains placeholder

Elastic Stack Logstash
,
10

Just found a similar issue with a solution, check this post.

You will need to some data_stream fields, basically you will need to create the fields:

  • datas_tream.type
  • data_stream.dataset
  • data_stream.namespace

You need this in your filter block:

mutate {
    add_field => {
      "[data_stream][type]" => "logs"
      "[data_stream][dataset]" => "ssc-misc-%{[instance_name]}-%{[instance_IP]}"
      "[data_stream][namespace]" => "nonprod"
    }
  }

And remove those settings from the output.

2 Likes