# Ingest pipeline - Override datastream

**URL:** <https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163>\
**Category:** Elastic Agent\
**Tags:** ingest-pipeline\
**Created:** [December 13, 2022, 8:05pm UTC](https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163 "2022-12-13T20:05:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeff.diademi](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@jeff.diademi](https://discuss.elastic.co/u/jeff.diademi)\
**Post date:** [December 13, 2022, 8:05pm UTC](https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163/1 "2022-12-13T20:05:17Z")

</div>

Today, I'm ingesting logs from kubernetes containers pods using elastic agent kubernetes integration. It works fine.

Now, I have a use case which is the following:  
Some specific logs records need to be ingested in another index, so I tried to override data\_stream.dataset field in ingest pipeline: logs-kubernetes.container\_logs@custom

The issue is the following mapping exception: `org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [data_stream.dataset] of type [constant_keyword] in document with id 'X3MRDYUBU7-AR-97HDwE'. Preview of field's value: 'my_test_app'`

How could it be implemented?

---

<div class="post-metadata">

**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\
**Post date:** [December 14, 2022, 6:18am UTC](https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163/2 "2022-12-14T06:18:23Z")

</div>

> [@jeff.diademi](#):
>
> constant\_keyword

Hi Jeff,

Welcome to Community!

> Constant keyword is a specialization of the keyword field for the case that all documents in the index have the same value.

It will not take multiple values .

And you cannot override the index in an integration.

> Routing documents based on values within the documents is not possible with Elastic Agent. You would need Logstash in between doing that for you.  
> Because, the Elastic Agent has an API key and that API key allows it to only write to a certain datastream.

---

<div class="post-metadata">

**Author:** ![jeff.diademi](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@jeff.diademi](https://discuss.elastic.co/u/jeff.diademi)\
**Post date:** [December 14, 2022, 6:48am UTC](https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163/3 "2022-12-14T06:48:20Z")

</div>

Ok, I understand, thanks for the reply.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2023, 6:48am UTC](https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163/4 "2023-01-11T06:48:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.