String inteprolation in logstash data_stream fields

I don't think this is supported, there was a similar question about it, and it seems that the data_stream settings will not sprintf the value.

I do not use data streams, but from the elasticsearch output documentation there is a setting named data_stream_auto_routing that may help you achieve what you want.

From what I understand, you will need to set this to true and create the following fields.

data_stream.type, data_stream.dataset and data_stream.namespace, then if those fields exist in the event, they will be used instead of the settings.