Index variable substitution not working

I'm trying in Logstash to write different indices (see documentation) but Logtash wont' substitute the variables.

My Logstash configuraiton:

    output {
      elasticsearch {
        hosts => ["http://elasticsearch-master:9200"]
        ilm_enabled => false
        index => "fluentbit-%{[kubernetes][cluster]}-%{+YYYY.MM.dd}"
        template => "/usr/share/logstash/config/logstash-template.json"
        template_name => "logstash-my-template"
        template_overwrite => "true"

      if [kubernetes][cluster] == "staging" {
        s3 {

The index is created as fluentbit-%{[kubernetes][cluster]}-2021-06-16 , this is, Logstash here is not evaluating and substituting the contents of [kubernetes][cluster]

This field always exist, as it's always injected at origin (Fluent Bit). Also, the second part (shipping to S3) works, so Logstash can get its value.

There are no other conflicting index names.

I've also tried combinations of settings, like not using the template* directives.

There are no Logstash errors logs (or any log for that matter once it's started). Logs are forwarded to ES correctly.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.