# Dynamic naming of data-streams

**URL:** https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281
**Category:** Logstash
**Tags:** datastreams
**Created:** [September 3, 2021, 1:10pm UTC](https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281 "2021-09-03T13:10:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![marcus\_lhisp](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@marcus\_lhisp](https://discuss.elastic.co/u/marcus_lhisp)
#### Post date: [September 3, 2021, 1:10pm UTC](https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281/1 "2021-09-03T13:10:17Z")

</div>

Hello,

Currently I'm trying to simplify my pipelines but unfortunately the sprintf format for field reference according to [Field References Deep Dive | Logstash Reference [7.14] | Elastic](https://www.elastic.co/guide/en/logstash/7.14/field-references-deepdive.html) does not work.

Am I doing something wrong here or is it just not possible?

Below you'll see the current settings of the pipeline:

```auto
input {
  pipeline { address => "pipeline-name" }
}

filter {
  grok {
    match => {"[log][path]" => "%{GREEDYDATA}/%{WORD:logfile}\.log" }
  }
}

output {
  elasticsearch {
    ssl => true
    cacert => "/etc/logstash/ssl/ca.crt"
    hosts => ["node001:9200", "node002:9200", "node003:9200"]
    user => "USER"
    password => "PASSWORD"
    data_stream => true
    data_stream_type => "logs"
    data_stream_dataset => "%{[fields][ingest][data_origin]}.%{[logfile]}"
    data_stream_namespace => "prod"
  }
}

```

For now I'm using an if-else construct with about 8-9 cases which I am quite unhappy about.

Maybe someone of here can share his thoughts.

EDIT: The data stream which gets created comes out like this:

```auto
logs-%{[fields][ingest][data_origin]}.%{[logfile]}-prod

```

Kind Regards,  
Marcus

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 3, 2021, 3:17pm UTC](https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281/2 "2021-09-03T15:17:55Z")

</div>

I see no indication in the [code](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/91b2de57a647e98ab85a4e2310a99717cc205b22/lib/logstash/outputs/elasticsearch/data_stream_support.rb#L176) that it sprintfs the dataset name, so that is the outcome I would expect.

---

<div class="post-metadata">

### Author: ![marcus\_lhisp](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@marcus\_lhisp](https://discuss.elastic.co/u/marcus_lhisp)
#### Post date: [September 3, 2021, 10:49pm UTC](https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281/3 "2021-09-03T22:49:32Z")

</div>

Thanks for taking the time to clarify this. Then I'll stuck with the if-else's.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 1, 2021, 10:49pm UTC](https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281/4 "2021-10-01T22:49:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.