Index alias for multiple indices

Hi,

I am currently working with Opendistro elasticsearch and we have been using ISM. The process is when a new Logstash configuration is created with a new index, we manually create a template for the index and create a new index with an alias and place the alias in Logstash.

We have a new requirement, where we will need to setup the same way we use currently but for new application. For example the new index will look like logstash-%%{app} where the app will be a tag, or a field from filebeat.

I am stuck now, because in this situation we may not know the application name in advance and hence not sure how to proceed. Can someone help here?

Any response for this issue?