Event attribute not resolved in elasticsearh output

Hello,
I'm using helm chart with image:

image: "docker.elastic.co/logstash/logstash-oss"
imageTag: "7.10.0"

I provide the following configuration in values.yml:

logstashPipeline:
  logstash.conf: |
    input {
      beats {
          port => 5044
          include_codec_tag => false
      }
    }
    filter {
       // some working filter rules here
    }
    output {
      stdout {
        codec => rubydebug
      }
      elasticsearch {
        hosts => ["http://elasticsearch-master:9200"]
        index => "cdn-logstash-%{[country]}-%{+YYYY.MM.dd}"
        manage_template => false
        ilm_enabled => false
        ssl => false
      }
    }

But, the event field variable in index name seems not to be resolved:

> curl -X GET ingress.elastic.io/_cat/indices

yellow open cdn-logstash-%{[country]}-2020.12.23 VEyPS-OlTQ-6hKCExWl43Q 1 1   48 0  80.9kb  80.9kb

Should these vars be resolved using the above format ?
It seems the context is lost and variable format %{} is ignored.

Thanks for any help

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.