Can't access Elasticsearch index name metadata in Logstash filter

Question

I want to add the elasticsearch index name as a field in the event when processing in Logstash. This is suppose to be pretty straight forward but the index name does not get printed out. Here is the complete Logstash config.

input {
    elasticsearch {
        hosts => "elasticsearch.example.com"
        index => "*-logs"
    }
}
filter {
    mutate {
        add_field => {
            "log_source" => "%{[@metadata][_index]}"
        }
    }
}
output {
    elasticsearch {
            index => "logstash-%{+YYYY.MM}"
    }
}

This will result in log_source being set to %{[@metadata][_index]} and not the actual name of the index. I have tried this with _id and without the underscores but it will always just output the reference and not the value.

Doing just %{[@metadata]} crashes Logstash with the error that it's trying to accessing the list incorrectly so [@metadata] is being set but it seems like index or any values are missing.

Does anyone have a another way of assigning the index name to the event?

I am using 5.0.1 of both Logstash and Elasticsearch.

Answer 1

You're almost there, you're simply missing the docinfo setting, which is false by default:

input {
    elasticsearch {
        hosts => "elasticsearch.example.com"
        index => "*-logs"
        docinfo => true
    }
}