Can you try something like this: [logstash-]YYYY.MM.DD,[dc1_logstash-]YYYY.MM.DD,[dc2_logstash-]YYYY.MM.DD
-- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/c43a1533-edbe-4d65-9be9-dba173f6f076%40googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.