Unable to create index based on POD names with provided prefix

Elastic Stack Elasticsearch
1

We used multi_format format to read logs but then indexes are not created properly with pod names. Here it seems unable to read pod_name using below prefix :

logstash_prefix "{ENV['K8S_NODE_NAME']}-${record['kubernetes']['pod_name']}"

Indexes are created as below :
efk-stack-${record['kubernetes']['pod_name']}-2024.06.28

2

Creating an index per pod per day sounds like a very bad idea as it means you risk having a lot of very small shards and indices, which can be very inefficient and cause problems. I would recommend you read this part of the docs and follow the recommendations provided there.