Vector Sink Elasticsearch Version 9 cannot create datastream

[ByeongwooJang]

Question

Elasticsearch : 9.0.3
Vector : 0.48.0-alpine

The vector was distributed to Kubernetes using helm chart.
My customConfig is as follows.
I already tried to api_version change auto, v8. but no one worked well.

it only make index, not datastream

is there any way to work well?

customConfig:
  sources:
    please:
      type: kafka
      bootstrap_servers: ~~~
      group_id: vector
      topics:
      - please
      sasl:
        enabled: true
        mechanism: PLAIN
        username: $$ConnectionString
        password: Endpoint=sb://~~~
      tls:
        enabled: true
        verify_certificate: true
      librdkafka_options:
        "security.protocol": sasl_ssl

  transforms:
    parse_and_explode_records:
      type: remap
      inputs:
        - please
      source: |
        del(.headers)
        del(.message_key)
        del(.offset)
        del(.partition)
        del(.source_type)

        if !is_null(.message) {
          .data = parse_json(.message) ?? {}
          del(.message)
        }
        . = unnest!(.data.records)

        if exists(.identity) && is_object(.identity) {
          . = {}
          .identity = encode_json(.identity)
        }
        

    route_by_log_type:
      type: route
      inputs:
        - parse_and_explode_records # 수정된 파서의 출력 사용
      route:  
        audit_logs: 
          source: 'exists(.data.records.category) && .data.records.category == "AuditLogs"'
          type: vrl
        signin_logs: 
          source: 'exists(.data.records.category) && .data.records.category == "SignInLogs"'
          type: vrl
        activity_logs: 
          source: 'exists(.data.records.category) && .data.records.category == "Administrative"'
          type: vrl
        unknown_logs: 'true'
    
  sinks:
    sink_please_audit:
      type: elasticsearch
      api_version: v8
      inputs:
        - route_by_log_type.audit_logs 
      endpoints: 
        - "https://auth-activiy-log-elasticsearch.auth-activiy-log.svc.cluster.local:9200"
      bulk:
        action: create
        index: "azure-please-audit-%Y-%m-%d" 
      mode: "data_stream"
      data_stream:
        type: azure
        dataset: please
        namespace: audit
      auth:
        strategy: "basic"
        user: "logstash_writer"
        password: "~~~~"
      tls:
        verify_certificate: false

    sink_please_signin:
      type: elasticsearch
      api_version: v8
      inputs:
        - route_by_log_type.signin_logs 
      endpoints: 
        - "https://auth-activiy-log-elasticsearch.auth-activiy-log.svc.cluster.local:9200"
      bulk:
        action: create
        index: "azure-please-signin-%Y-%m-%d" 
      mode: "data_stream"
      data_stream:
        type: azure
        dataset: please
        namespace: signin 
      auth:
        strategy: "basic"
        user: "logstash_writer"
        password: "~~~~"
      tls:
        verify_certificate: false

    sink_please_activity:
      type: elasticsearch
      api_version: v8
      inputs:
        - route_by_log_type.activity_logs 
      endpoints: 
        - "https://auth-activiy-log-elasticsearch.auth-activiy-log.svc.cluster.local:9200"
      bulk:
        action: create
        index: "azure-please-activity-%Y-%m-%d"
      mode: "data_stream"
      data_stream:
        type: azure
        dataset: please
        namespace: activity 
      auth:
        strategy: "basic"
        user: "logstash_writer"
        password: "~~~~"
      tls:
        verify_certificate: false

    sink_please_unknown:
      type: elasticsearch
      api_version: v8
      inputs:
        - route_by_log_type.unknown_logs
      endpoints: 
        - "https://auth-activiy-log-elasticsearch.auth-activiy-log.svc.cluster.local:9200"
      bulk:
        action: create
        index: "azure-please-unknown-%Y-%m-%d"
      mode: "data_stream"
      data_stream:
        type: azure
        dataset: please
        namespace: unknown
      auth:
        strategy: "basic"
        user: "logstash_writer"
        password: "~~~~"
      tls:
        verify_certificate: false```

### Vector Config

_No response_

### Vector Logs

_No response_

[ByeongwooJang]

[ByeongwooJang]

i am stupid
https://www.elastic.co/docs/reference/fleet/data-streams#data-streams-naming-scheme
Stupid people like me, make sure to check it out