You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The **es** output plugin lets you ingest your records into an
8
-
[Elasticsearch](http://www.elastic.co) database. To use this plugin, you must have an
9
-
operational Elasticsearch service running in your environment.
7
+
The _Elasticsearch_ (`es`) output plugin lets you ingest your records into an [Elasticsearch](http://www.elastic.co) database. To use this plugin, you must have an operational Elasticsearch service running in your environment.
10
8
11
-
## Configuration Parameters
9
+
## Configuration parameters
10
+
11
+
This plugin has the following configuration parameters:
12
12
13
13
| Key | Description | Default |
14
14
| :--- | :--- | :--- |
@@ -56,8 +56,7 @@ be compared to the `database` and `table` concepts.
56
56
57
57
### TLS / SSL
58
58
59
-
The Elasticsearch output plugin supports TLS/SSL.
60
-
For more details about the properties available and general configuration, see [TLS/SSL](../../administration/transport-security.md).
59
+
The Elasticsearch output plugin supports TLS/SSL. For more details about the properties available and general configuration, see [TLS/SSL](../../administration/transport-security.md).
61
60
62
61
### `write_operation`
63
62
@@ -78,12 +77,11 @@ The `write_operation` can be any of:
78
77
79
78
## Get started
80
79
81
-
To insert records into an Elasticsearch service, you run the plugin from the
82
-
command line or through the configuration file:
80
+
To insert records into an Elasticsearch service, run the plugin from the command line or through the configuration file.
83
81
84
-
### Command Line
82
+
### Command line
85
83
86
-
The **es** plugin can read the parameters from the command line in two ways:
84
+
The `es` plugin can read the parameters from the command line in the following ways:
87
85
88
86
- Through the `-p` argument (property).
89
87
- Setting them directly through the service URI.
@@ -108,9 +106,9 @@ fluent-bit -i cpu -t cpu -o es -p Host=192.168.2.3 -p Port=9200 \
In your main configuration file append the following `Input` and `Output`sections.
111
+
In your main configuration file append the following sections.
114
112
115
113
{% tabs %}
116
114
{% tab title="fluent-bit.yaml" %}
@@ -120,7 +118,7 @@ pipeline:
120
118
inputs:
121
119
- name: cpu
122
120
tag: cpu
123
-
121
+
124
122
outputs:
125
123
- name: es
126
124
match: '*'
@@ -151,11 +149,10 @@ pipeline:
151
149
{% endtab %}
152
150
{% endtabs %}
153
151
154
-
## About Elasticsearch field names
152
+
## Elasticsearch field names
155
153
156
-
Some input plugins can generate messages where the field names contains dots. For
157
-
Elasticsearch 2.0, this isn't allowed. The current **es** plugin replaces
158
-
them with an underscore:
154
+
Some input plugins can generate messages where the field names contains dots (`.`). For Elasticsearch 2.0, this isn't allowed. The current `es` plugin replaces
155
+
a dot with an underscore (`_`):
159
156
160
157
```text
161
158
{"cpu0.p_cpu"=>17.000000}
@@ -173,9 +170,7 @@ Connect to Amazon OpenSearch or Elastic Cloud with the ElasticSearch plugin.
173
170
174
171
### Amazon OpenSearch Service
175
172
176
-
The Amazon OpenSearch Service adds an extra security layer where HTTP requests must
177
-
be signed with AWS Sigv4. Fluent Bit v1.5 introduced full support for Amazon
178
-
OpenSearch Service with IAM Authentication.
173
+
The Amazon OpenSearch Service adds an extra security layer where HTTP requests must be signed with AWS Sigv4. Fluent Bit v1.5 introduced full support for Amazon OpenSearch Service with IAM Authentication.
179
174
180
175
See [details](https://github.com/fluent/fluent-bit-docs/tree/43c4fe134611da471e706b0edb2f9acd7cdfdbc3/administration/aws-credentials.md) on how AWS credentials are fetched.
181
176
@@ -186,7 +181,7 @@ Example configuration:
186
181
187
182
```yaml
188
183
pipeline:
189
-
184
+
190
185
outputs:
191
186
- name: es
192
187
match: '*'
@@ -222,21 +217,15 @@ Be aware that the `Port` is set to `443`, `tls` is enabled, and `AWS_Region` is
by providing the `cloud_id` and the `cloud_auth` settings. `cloud_auth` uses the
228
-
`elastic` user and password provided when the cluster was created. For details refer
229
-
to the
230
-
[Cloud ID usage page](https://www.elastic.co/guide/en/cloud/current/ec-cloud-id.html).
231
-
220
+
Fluent Bit supports connecting to [Elastic Cloud](https://www.elastic.co/guide/en/cloud/current/ec-getting-started.html) by providing the `cloud_id` and the `cloud_auth` settings. `cloud_auth` uses the `elastic` user and password provided when the cluster was created. For details refer to the [Cloud ID usage page](https://www.elastic.co/guide/en/cloud/current/ec-cloud-id.html).
232
221
Example configuration:
233
222
234
223
{% tabs %}
235
224
{% tab title="fluent-bit.yaml" %}
236
225
237
226
```yaml
238
227
pipeline:
239
-
228
+
240
229
outputs:
241
230
- name: es
242
231
include_tag_key: true
@@ -281,9 +270,7 @@ Use the following information to help resolve errors using the ElasticSearch plu
281
270
282
271
### Using multiple types in a single index
283
272
284
-
Elasticsearch 6.0 can't create multiple types in a single index. An error message
285
-
like the following indicates you need to update your configuration to use a single
286
-
type on each index.
273
+
Elasticsearch 6.0 can't create multiple types in a single index. An error message like the following indicates you need to update your configuration to use a single type on each index.
287
274
288
275
```text
289
276
Rejecting mapping update to [products] as the final mapping would have more than 1 type:
@@ -296,7 +283,7 @@ This means that you can't set up your configuration like the following:.
296
283
297
284
```yaml
298
285
pipeline:
299
-
286
+
300
287
outputs:
301
288
- name: es
302
289
match: 'foo.*'
@@ -333,23 +320,18 @@ For details, read [the official blog post on that issue](https://www.elastic.co/
333
320
334
321
### Mapping type names can't start with underscores (`_`)
335
322
336
-
Fluent Bit v1.5 changed the default mapping type from `flb_type` to `_doc`, matching
337
-
the recommendation from Elasticsearch for version 6.2 and greater
Fluent Bit v1.5 changed the default mapping type from `flb_type` to `_doc`, matching the recommendation from Elasticsearch for version 6.2 and greater ([see commit with rationale](https://github.com/fluent/fluent-bit/commit/04ed3d8104ca8a2f491453777ae6e38e5377817e#diff-c9ae115d3acaceac5efb949edbb21196)).
340
324
341
-
This doesn't work in Elasticsearch versions 5.6 through 6.1
342
-
([discussion and fix](https://discuss.elastic.co/t/cant-use-doc-as-type-despite-it-being-declared-the-preferred-method/113837/9)).
325
+
This doesn't work in Elasticsearch versions 5.6 through 6.1 ([discussion and fix](https://discuss.elastic.co/t/cant-use-doc-as-type-despite-it-being-declared-the-preferred-method/113837/9)).
343
326
344
-
Ensure you set an explicit map such as `doc` or `flb_type` in the configuration,
345
-
as seen on the last line:
327
+
Ensure you set an explicit map such as `doc` or `flb_type` in the configuration, as seen on the last line:
346
328
347
329
{% tabs %}
348
330
{% tab title="fluent-bit.yaml" %}
349
331
350
332
```yaml
351
333
pipeline:
352
-
334
+
353
335
outputs:
354
336
- name: es
355
337
match: '*'
@@ -383,24 +365,20 @@ pipeline:
383
365
384
366
### Validation failures
385
367
386
-
In Fluent Bit v1.8.2 and greater, Fluent Bit started using `create` method (instead
387
-
of `index`) for data submission. This makes Fluent Bit compatible with `Datastream`,
388
-
introduced in Elasticsearch 7.9. You might see errors like:
368
+
In Fluent Bit v1.8.2 and greater, Fluent Bit started using `create` method (instead of `index`) for data submission. This makes Fluent Bit compatible with `Datastream`, introduced in Elasticsearch 7.9. You might see errors like:
389
369
390
370
```text
391
371
Validation Failed: 1: an id must be provided if version type or value are set
392
372
```
393
373
394
-
If you see `action_request_validation_exception` errors on your pipeline with
395
-
Fluent Bit versions greater than v1.8.2, correct them by turning on `Generate_ID`
396
-
as follows:
374
+
If you see `action_request_validation_exception` errors on your pipeline with Fluent Bit versions greater than v1.8.2, correct them by turning on `Generate_ID` as follows:
397
375
398
376
{% tabs %}
399
377
{% tab title="fluent-bit.yaml" %}
400
378
401
379
```yaml
402
380
pipeline:
403
-
381
+
404
382
outputs:
405
383
- name: es
406
384
match: '*'
@@ -424,21 +402,20 @@ pipeline:
424
402
425
403
### `Logstash_Prefix_Key`
426
404
427
-
The following snippet demonstrates using the namespace name as extracted by the
428
-
`kubernetes` filter as `logstash` prefix:
405
+
The following snippet demonstrates using the namespace name as extracted by the `kubernetes` filter as `logstash` prefix:
0 commit comments