Take a look at data_stream_auto_routing. Looking at the code it expects a field called [data_stream]
{ "data_stream": { "type": "foo", "dataset": "bar", "namespace": "baz" } }
You could build that using sprintf references in a mutate filter.
2 Likes