Skip to main content
Version: Next

to_opensearch

Sends events to an OpenSearch-compatible Bulk API.

to_opensearch url:string, action=string, [index=string, id=string, doc=record,
    user=string, passwd=string, skip_peer_verification=bool, cacert=string,
    certfile=string, keyfile=string, include_nulls=bool, max_content_length=int,
    buffer_timeout=duration, compress=bool]

Description​

The to_opensearch operator sends events to a OpenSearch-compatible Bulk API such as ElasticSearch.

The operator accumulates multiple events before sending them as a single request. You can control the maximum request size via the max_content_length and the timeout before sending all accumulated events via the send_timeout option.

url: string​

The URL of the API endpoint.

action = string​

An expression for the action that evaluates to a string.

Supported actions:

  • create: Creates a document if it doesn’t already exist and returns an error otherwise.
  • delete: Deletes a document if it exists.
  • index: Creates a document if it doesn’t yet exist and replace the document if it already exists.
  • update: Updates existing documents and returns an error if the document doesn’t exist.
  • upsert: If a document exists, it is updated; if it does not exist, a new document is indexed.

index = string (optional)​

An optional expression for the index that evaluates to a string.

Must be provided if the url does not have an index.

id = string (optional)​

The id of the document to act on.

Must be provided when using the delete and update actions.

doc = record (optional)​

The document to serialize.

Defaults to this.

user = string (optional)​

Optional user for HTTP Basic Authentication.

passwd = string (optional)​

Optional password for HTTP Basic Authentication.

skip_peer_verification = bool (optional)​

Toggles TLS certificate verification.

Defaults to false.

cacert = string (optional)​

Path to the CA certificate used to verify the server's certificate.

certfile = string (optional)​

Path to the client certificate.

keyfile = string (optional)​

Path to the key for the client certificate.

include_nulls = bool (optional)​

Include fields with null values in the transmitted event data. By default, the operator drops all null values to save space.

Defaults to false.

max_content_length = int (optional)​

The maximum size of the message uncompressed body in bytes. A message may consist of multiple events. If a single event is larger than this limit, it is dropped and a warning is emitted.

Defaults to 5Mi.

buffer_timeout = duration (optional)​

The maximum amount of time for which the operator accumulates messages before sending them out to the HEC endpoint as a single message.

Defaults to 5s.

compress = bool (optional)​

Whether to compress the message body using standard gzip.

Defaults to true.

Examples​

Send events from a JSON file​

from "example.json"
to_opensearch "localhost:9200", action="create", index="main"