Hi,
Unfortunatly, that doesn't work with both
data_stream_dataset => "%{[@metadata][dataset]}"
or
data_stream_dataset => "%{facility}"
[WARN ] 2023-02-10 17:14:04.698 [[main]>worker3] elasticsearch - Badly formatted index, after interpolation still contains placeholder: [logs-%{[@metadata][dataset]}-prod]; ...
[WARN ] 2023-02-10 16:36:50.734 [[main]>worker1] elasticsearch - Badly formatted index, after interpolation still contains placeholder: [logs-%{facility}-prod]; ...
Found this issue which seems to talk about it...
Use metadata for data_stream_auto_routing · Issue #13528 · elastic/logstash · GitHub