# Index variable substitution not working

**URL:** <https://discuss.elastic.co/t/index-variable-substitution-not-working/276169>\
**Category:** Logstash\
**Created:** [June 16, 2021, 4:51pm UTC](https://discuss.elastic.co/t/index-variable-substitution-not-working/276169 "2021-06-16T16:51:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![devopscanada](https://avatars.discourse-cdn.com/v4/letter/d/f14d63/32.png) [@devopscanada](https://discuss.elastic.co/u/devopscanada)\
**Post date:** [June 16, 2021, 4:51pm UTC](https://discuss.elastic.co/t/index-variable-substitution-not-working/276169/1 "2021-06-16T16:51:13Z")

</div>

I'm trying in Logstash to write different indices (see [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#_writing_to_different_indices_best_practices)) but Logtash wont' substitute the variables.

My Logstash configuraiton:

```auto
    output {
      elasticsearch {
        hosts => ["http://elasticsearch-master:9200"]
        ilm_enabled => false
        index => "fluentbit-%{[kubernetes][cluster]}-%{+YYYY.MM.dd}"
        template => "/usr/share/logstash/config/logstash-template.json"
        template_name => "logstash-my-template"
        template_overwrite => "true"
      }

      if [kubernetes][cluster] == "staging" {
        s3 {
         ...

```

The index is created as `fluentbit-%{[kubernetes][cluster]}-2021-06-16` , this is, Logstash here is not evaluating and substituting the contents of `[kubernetes][cluster]`

This field always exist, as it's always injected at origin (Fluent Bit). Also, the second part (shipping to S3) works, so Logstash can get its value.

There are no other conflicting index names.

I've also tried combinations of settings, like not using the template\* directives.

There are no Logstash errors logs (or any log for that matter once it's started). Logs are forwarded to ES correctly.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2021, 4:52pm UTC](https://discuss.elastic.co/t/index-variable-substitution-not-working/276169/2 "2021-07-14T16:52:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.