From bcf268d9d806515a2a51f6b34d58377aa00f0ed2 Mon Sep 17 00:00:00 2001 From: Rob Bavey Date: Mon, 15 Sep 2025 11:25:08 -0400 Subject: [PATCH] Update data streams documentation to note that sprintf syntax is not supported Using sprintf syntax in the `data_streams` options is not supported. This commit adds a supplemental note, explaining this, and providing an example on how to dynamically route using `mutate` filter and the auto routing facility. Relates: https://github.com/elastic/logstash/issues/17689 --- docs/index.asciidoc | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/index.asciidoc b/docs/index.asciidoc index 1cb062d1..9a0ba216 100644 --- a/docs/index.asciidoc +++ b/docs/index.asciidoc @@ -136,6 +136,22 @@ output { } ----- +NOTE: Dynamic variable substitution using sprintf syntax, such as %{foo}, is not supported in the `data_stream` options + at this time. If you want to dynamically route to data streams, you can add the appropriate fields to events in + the configuration and take advantage of the (on by default) auto routing facility: + +[source,sh] +----- +filter { + mutate { + add_field => { + "[data_stream][type]" => "logs" + "[data_stream][dataset]" => "%{dataset_name}" + "[data_stream][namespace]" => "%{namespace_name}" + } + } +} +----- ==== Writing to different indices: best practices