I'm running ES 8.17.0 on basic subscription, ingesting logs from Cloudwatch. Note we are not using the Agent to pull these logs, but rather send them to _bulk with a lambda function.
We had been ingesting these to an index, but not leveraging any ECS capabilities, so I'm in the process of migrating to using the aws-cloudwatch managed templates/pipelines etc.
My question is this: I have multiple environments/namespaces with different lifecycle needs, and I can't quite get my head around how to specify a different lifecycle policy and rollover alias using the *@custom component templates. The doc below suggests something like this should be possible using variables like '{index}-alias' for the rollover alias, but in practice this just seems to make the alias the literal string.
Is this a bug or am I going about this the wrong way?