<p>we are using Fluentd to push kubernetes container logs to Elasticsearch. and we want to create indices on Elasticsearch in format of NAMESPACE_CONTAINERNAME. below is our config of record transformer and Elasticsearch outPut plugin.</p>
<pre><code>      &lt;filter kubernetes.**&gt;
        @type record_transformer
        enable_ruby true
        &lt;record&gt;
          container_name ${record[&quot;kubernetes&quot;][&quot;container_name&quot;]}
          namespace ${record[&quot;kubernetes&quot;][&quot;namespace_name&quot;]}
          pod ${record[&quot;kubernetes&quot;][&quot;pod_name&quot;]}
          host ${record[&quot;kubernetes&quot;][&quot;host&quot;]}
          app ${record[&quot;kubernetes&quot;][&quot;labels&quot;][&quot;app&quot;]}
        &lt;/record&gt;
      &lt;/filter&gt;
</code></pre>
<p>Elasticsearch Output:</p>
<pre><code>    &lt;label @OUTPUT&gt;
      &lt;match **&gt;
        @type elasticsearch
        host &quot;elasticsearch-master.default.svc.cluster.local&quot;
        port 9200
        logstash_format true
        logstash_prefix ${namespace}_${container_name}
      &lt;/match&gt;
    &lt;/label&gt;
</code></pre>
<p>but when Fluentd pushing logs to Elasticsearch, indices getting created as <em>${namespace}_${container_name}-2021.02.25</em>.
any suggestion or guidance on this most welcome. :slightly_smiling_face:</p>

chitender kumar
<p>was able to make it work by adding buffer section.</p>
<pre><code>    &lt;label @OUTPUT&gt;
      &lt;match **&gt;
        @type elasticsearch
        host &quot;#{ENV['FLUENT_ELASTICSEARCH_HOST']}&quot;
        port &quot;#{ENV['FLUENT_ELASTICSEARCH_PORT']}&quot;
        logstash_format true
        logstash_prefix ${namespace}_${container_name}
        &lt;buffer tag, container_name, namespace&gt;
          @type file
          path /var/log/${container_name}/app.log
        &lt;/buffer&gt;
      &lt;/match&gt;
    &lt;/label&gt;
</code></pre>
