logstash-output-elasticsearch 10.8.1-java → 10.8.2-java
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/README.md +1 -1
- data/docs/index.asciidoc +155 -98
- data/logstash-output-elasticsearch.gemspec +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: d6c80e3faba2acade7f891f8e55f4371859337b80457051529264bed69ef0151
|
4
|
+
data.tar.gz: 00d8cfa6da32835ba9151f5f379c416bd0d4b5ea4d26d05e179da922ede8d8ed
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 311b6c538024338a609f5d101e91157487fe5ddb1c876f1cfef7426cd1f721dd46ade457b47052d7387238c76c11f88288f334caf0549506564f6d11bfadc3e3
|
7
|
+
data.tar.gz: f6af92b3f7438531b77f81dce0da90e0a0d495bf1a3bcb49929112d267388a68f6897596c3fca580d81360279b41fa0ae378d822022c146890491eb2c92e5810
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,6 @@
|
|
1
|
+
## 10.8.2
|
2
|
+
- [DOC] Update links to use shared attributes [#985](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/985)
|
3
|
+
|
1
4
|
## 10.8.1
|
2
5
|
- Fixed an issue when assigning the no-op license checker [#984](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/984)
|
3
6
|
|
data/README.md
CHANGED
@@ -1,6 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[![Travis Build Status](https://travis-ci.
|
3
|
+
[![Travis Build Status](https://travis-ci.com/logstash-plugins/logstash-output-elasticsearch.svg)](https://travis-ci.com/logstash-plugins/logstash-output-elasticsearch)
|
4
4
|
|
5
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
6
6
|
|
data/docs/index.asciidoc
CHANGED
@@ -29,12 +29,12 @@ This output only speaks the HTTP protocol as it is the preferred protocol for
|
|
29
29
|
interacting with Elasticsearch. In previous versions it was possible to
|
30
30
|
communicate with Elasticsearch through the transport protocol, which is now
|
31
31
|
reserved for internal cluster communication between nodes
|
32
|
-
|
33
|
-
Using the
|
34
|
-
|
35
|
-
will be removed in 8.0.0
|
32
|
+
{ref}/modules-transport.html[communication between nodes].
|
33
|
+
Using the transport protocol to communicate with the cluster has been deprecated
|
34
|
+
in Elasticsearch 7.0.0 and will be removed in 8.0.0
|
36
35
|
|
37
|
-
You can
|
36
|
+
You can https://www.elastic.co/elasticsearch/[learn more about Elasticsearch] on
|
37
|
+
the website landing page or in the {ref}[Elasticsearch documentation].
|
38
38
|
|
39
39
|
.Compatibility Note
|
40
40
|
[NOTE]
|
@@ -103,9 +103,8 @@ Example:
|
|
103
103
|
|
104
104
|
**What to do in case there is no field in the event containing the destination index prefix?**
|
105
105
|
|
106
|
-
You can use the `mutate` filter and conditionals to add a
|
107
|
-
|
108
|
-
https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#metadata)
|
106
|
+
You can use the `mutate` filter and conditionals to add a
|
107
|
+
{logstash-ref}/event-dependent-configuration.html#metadata[`[@metadata]` field]
|
109
108
|
to set the destination index for each event. The `[@metadata]` fields will not
|
110
109
|
be sent to Elasticsearch.
|
111
110
|
|
@@ -159,30 +158,37 @@ happens, the problem is logged as a warning, and the event is dropped. See
|
|
159
158
|
[id="plugins-{type}s-{plugin}-ilm"]
|
160
159
|
==== Index Lifecycle Management
|
161
160
|
|
162
|
-
|
163
161
|
[NOTE]
|
164
162
|
The Index Lifecycle Management feature requires plugin version `9.3.1` or higher.
|
165
163
|
|
166
164
|
[NOTE]
|
167
165
|
This feature requires an Elasticsearch instance of 6.6.0 or higher with at least a Basic license
|
168
166
|
|
169
|
-
Logstash can use {ref}/index-lifecycle-management.html[Index Lifecycle
|
167
|
+
Logstash can use {ref}/index-lifecycle-management.html[Index Lifecycle
|
168
|
+
Management] to automate the management of indices over time.
|
170
169
|
|
171
170
|
The use of Index Lifecycle Management is controlled by the `ilm_enabled`
|
172
171
|
setting. By default, this setting detects whether the Elasticsearch instance
|
173
172
|
supports ILM, and uses it if it is available. `ilm_enabled` can also be set to
|
174
173
|
`true` or `false` to override the automatic detection, or disable ILM.
|
175
174
|
|
176
|
-
This will overwrite the index settings and adjust the Logstash template to write
|
177
|
-
|
175
|
+
This will overwrite the index settings and adjust the Logstash template to write
|
176
|
+
the necessary settings for the template to support index lifecycle management,
|
177
|
+
including the index policy and rollover alias to be used.
|
178
178
|
|
179
|
-
Logstash will create a rollover alias for the indices to be written to,
|
180
|
-
a
|
179
|
+
Logstash will create a rollover alias for the indices to be written to,
|
180
|
+
including a pattern for how the actual indices will be named, and unless an ILM
|
181
|
+
policy that already exists has been specified, a default policy will also be
|
182
|
+
created. The default policy is configured to rollover an index when it reaches
|
183
|
+
either 50 gigabytes in size, or is 30 days old, whichever happens first.
|
181
184
|
|
182
|
-
The default rollover alias is called `logstash`, with a default pattern for the
|
183
|
-
which will name indices on the date that the
|
185
|
+
The default rollover alias is called `logstash`, with a default pattern for the
|
186
|
+
rollover index of `{now/d}-00001`, which will name indices on the date that the
|
187
|
+
index is rolled over, followed by an incrementing number. Note that the pattern
|
188
|
+
must end with a dash and a number that will be incremented.
|
184
189
|
|
185
|
-
See the {ref}/indices-rollover-index.html#_using_date_math_with_the_rollover_api[Rollover
|
190
|
+
See the {ref}/indices-rollover-index.html#_using_date_math_with_the_rollover_api[Rollover
|
191
|
+
API documentation] for more details on naming.
|
186
192
|
|
187
193
|
The rollover alias, ilm pattern and policy can be modified.
|
188
194
|
|
@@ -198,19 +204,24 @@ See config below for an example:
|
|
198
204
|
|
199
205
|
NOTE: Custom ILM policies must already exist on the Elasticsearch cluster before they can be used.
|
200
206
|
|
201
|
-
NOTE: If the rollover alias or pattern is modified, the index template will need to be
|
207
|
+
NOTE: If the rollover alias or pattern is modified, the index template will need to be
|
208
|
+
overwritten as the settings `index.lifecycle.name` and
|
209
|
+
`index.lifecycle.rollover_alias` are automatically written to the template
|
202
210
|
|
203
211
|
NOTE: If the index property is supplied in the output definition, it will be overwritten by the rollover alias.
|
204
212
|
|
205
213
|
|
206
214
|
==== Batch Sizes
|
207
215
|
|
208
|
-
This plugin attempts to send batches of events
|
209
|
-
|
216
|
+
This plugin attempts to send batches of events to the {ref}/docs-bulk.html[{es}
|
217
|
+
Bulk API] as a single request. However, if a batch exceeds 20MB we break it up
|
218
|
+
into multiple bulk requests. If a single document exceeds 20MB it is sent as a
|
219
|
+
single request.
|
210
220
|
|
211
221
|
==== DNS Caching
|
212
222
|
|
213
|
-
This plugin uses the JVM to lookup DNS entries and is subject to the value of
|
223
|
+
This plugin uses the JVM to lookup DNS entries and is subject to the value of
|
224
|
+
https://docs.oracle.com/javase/7/docs/technotes/guides/net/properties.html[networkaddress.cache.ttl],
|
214
225
|
a global setting for the JVM.
|
215
226
|
|
216
227
|
As an example, to set your DNS TTL to 1 second you would set
|
@@ -226,8 +237,7 @@ enabled by default for HTTP and for Elasticsearch versions 5.0 and later.
|
|
226
237
|
|
227
238
|
You don't have to set any configs in Elasticsearch for it to send back a
|
228
239
|
compressed response. For versions before 5.0, or if HTTPS is enabled,
|
229
|
-
`http.compression` must be set to `true`
|
230
|
-
https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html#modules-http[in
|
240
|
+
`http.compression` must be set to `true` {ref}/modules-http.html#modules-http[in
|
231
241
|
Elasticsearch] to take advantage of response compression when using this plugin.
|
232
242
|
|
233
243
|
For requests compression, regardless of the Elasticsearch version, enable the
|
@@ -235,19 +245,23 @@ For requests compression, regardless of the Elasticsearch version, enable the
|
|
235
245
|
|
236
246
|
==== Authentication
|
237
247
|
|
238
|
-
Authentication to a secure Elasticsearch cluster is possible using one of the
|
248
|
+
Authentication to a secure Elasticsearch cluster is possible using one of the
|
249
|
+
`user`/`password`, `cloud_auth` or `api_key` options.
|
239
250
|
|
240
251
|
[id="plugins-{type}s-{plugin}-autz"]
|
241
252
|
==== Authorization
|
242
253
|
|
243
|
-
Authorization to a secure Elasticsearch cluster requires `read` permission at
|
244
|
-
|
254
|
+
Authorization to a secure Elasticsearch cluster requires `read` permission at
|
255
|
+
index level and `monitoring` permissions at cluster level. The `monitoring`
|
256
|
+
permission at cluster level is necessary to perform periodic connectivity
|
257
|
+
checks.
|
245
258
|
|
246
259
|
|
247
260
|
[id="plugins-{type}s-{plugin}-options"]
|
248
261
|
==== Elasticsearch Output Configuration Options
|
249
262
|
|
250
|
-
This plugin supports the following configuration options plus the
|
263
|
+
This plugin supports the following configuration options plus the
|
264
|
+
<<plugins-{type}s-{plugin}-common-options>> described later.
|
251
265
|
|
252
266
|
[cols="<,<,<",options="header",]
|
253
267
|
|=======================================================================
|
@@ -335,7 +349,8 @@ The Elasticsearch action to perform. Valid actions are:
|
|
335
349
|
- A sprintf style string to change the action based on the content of the event. The value `%{[foo]}`
|
336
350
|
would use the foo field for the action
|
337
351
|
|
338
|
-
For more details on actions, check out the
|
352
|
+
For more details on actions, check out the {ref}/docs-bulk.html[Elasticsearch
|
353
|
+
bulk API documentation].
|
339
354
|
|
340
355
|
[id="plugins-{type}s-{plugin}-api_key"]
|
341
356
|
===== `api_key`
|
@@ -343,9 +358,11 @@ For more details on actions, check out the http://www.elastic.co/guide/en/elasti
|
|
343
358
|
* Value type is <<password,password>>
|
344
359
|
* There is no default value for this setting.
|
345
360
|
|
346
|
-
Authenticate using Elasticsearch API key. Note that this option also requires
|
361
|
+
Authenticate using Elasticsearch API key. Note that this option also requires
|
362
|
+
enabling the `ssl` option.
|
347
363
|
|
348
|
-
Format is `id:api_key` where `id` and `api_key` are as returned by the
|
364
|
+
Format is `id:api_key` where `id` and `api_key` are as returned by the
|
365
|
+
Elasticsearch {ref}/security-api-create-api-key.html[Create API key API].
|
349
366
|
|
350
367
|
[id="plugins-{type}s-{plugin}-bulk_path"]
|
351
368
|
===== `bulk_path`
|
@@ -362,7 +379,7 @@ this defaults to a concatenation of the path parameter and "_bulk"
|
|
362
379
|
* Value type is <<path,path>>
|
363
380
|
* There is no default value for this setting.
|
364
381
|
|
365
|
-
The .cer or .pem file to validate the server's certificate
|
382
|
+
The .cer or .pem file to validate the server's certificate.
|
366
383
|
|
367
384
|
[id="plugins-{type}s-{plugin}-cloud_auth"]
|
368
385
|
===== `cloud_auth`
|
@@ -370,9 +387,11 @@ The .cer or .pem file to validate the server's certificate
|
|
370
387
|
* Value type is <<password,password>>
|
371
388
|
* There is no default value for this setting.
|
372
389
|
|
373
|
-
Cloud authentication string ("<username>:<password>" format) is an alternative
|
390
|
+
Cloud authentication string ("<username>:<password>" format) is an alternative
|
391
|
+
for the `user`/`password` pair.
|
374
392
|
|
375
|
-
For more details, check out the
|
393
|
+
For more details, check out the
|
394
|
+
{logstash-ref}/connecting-to-cloud.html[Logstash-to-Cloud documentation].
|
376
395
|
|
377
396
|
[id="plugins-{type}s-{plugin}-cloud_id"]
|
378
397
|
===== `cloud_id`
|
@@ -382,7 +401,8 @@ For more details, check out the https://www.elastic.co/guide/en/logstash/current
|
|
382
401
|
|
383
402
|
Cloud ID, from the Elastic Cloud web console. If set `hosts` should not be used.
|
384
403
|
|
385
|
-
For more details, check out the
|
404
|
+
For more details, check out the
|
405
|
+
{logstash-ref}/connecting-to-cloud.html[Logstash-to-Cloud documentation].
|
386
406
|
|
387
407
|
[id="plugins-{type}s-{plugin}-doc_as_upsert"]
|
388
408
|
===== `doc_as_upsert`
|
@@ -391,7 +411,7 @@ For more details, check out the https://www.elastic.co/guide/en/logstash/current
|
|
391
411
|
* Default value is `false`
|
392
412
|
|
393
413
|
Enable `doc_as_upsert` for update mode.
|
394
|
-
Create a new document with source if `document_id` doesn't exist in Elasticsearch
|
414
|
+
Create a new document with source if `document_id` doesn't exist in Elasticsearch.
|
395
415
|
|
396
416
|
[id="plugins-{type}s-{plugin}-document_id"]
|
397
417
|
===== `document_id`
|
@@ -399,7 +419,8 @@ Create a new document with source if `document_id` doesn't exist in Elasticsearc
|
|
399
419
|
* Value type is <<string,string>>
|
400
420
|
* There is no default value for this setting.
|
401
421
|
|
402
|
-
The document ID for the index. Useful for overwriting existing entries in
|
422
|
+
The document ID for the index. Useful for overwriting existing entries in
|
423
|
+
Elasticsearch with the same ID.
|
403
424
|
|
404
425
|
[id="plugins-{type}s-{plugin}-document_type"]
|
405
426
|
===== `document_type`
|
@@ -408,8 +429,10 @@ The document ID for the index. Useful for overwriting existing entries in Elasti
|
|
408
429
|
* There is no default value for this setting.
|
409
430
|
* This option is deprecated
|
410
431
|
|
411
|
-
NOTE: This option is deprecated due to the
|
412
|
-
|
432
|
+
NOTE: This option is deprecated due to the
|
433
|
+
https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html[removal
|
434
|
+
of types in Elasticsearch 6.0]. It will be removed in the next major version of
|
435
|
+
Logstash.
|
413
436
|
|
414
437
|
NOTE: This value is ignored and has no effect for Elasticsearch clusters `8.x`.
|
415
438
|
|
@@ -433,9 +456,10 @@ If you don't set a value for this option:
|
|
433
456
|
** When Logstash provides a `pipeline.ecs_compatibility` setting, its value is used as the default
|
434
457
|
** Otherwise, the default value is `disabled`.
|
435
458
|
|
436
|
-
Controls this plugin's compatibility with the
|
437
|
-
|
438
|
-
|
459
|
+
Controls this plugin's compatibility with the
|
460
|
+
https://www.elastic.co/guide/en/ecs/current/index.html[Elastic Common Schema
|
461
|
+
(ECS)], including the installation of ECS-compatible index templates. The value
|
462
|
+
of this setting affects the _default_ values of:
|
439
463
|
|
440
464
|
* <<plugins-{type}s-{plugin}-index>>
|
441
465
|
* <<plugins-{type}s-{plugin}-template_name>>
|
@@ -479,8 +503,10 @@ If you have custom firewall rules you may need to change this
|
|
479
503
|
* Value type is <<uri,uri>>
|
480
504
|
* Default value is `[//127.0.0.1]`
|
481
505
|
|
482
|
-
Sets the host(s) of the remote instance. If given an array it will load balance
|
483
|
-
|
506
|
+
Sets the host(s) of the remote instance. If given an array it will load balance
|
507
|
+
requests across the hosts specified in the `hosts` parameter. Remember the
|
508
|
+
`http` protocol uses the {ref}/modules-http.html#modules-http[http] address (eg.
|
509
|
+
9200, not 9300).
|
484
510
|
|
485
511
|
Examples:
|
486
512
|
|
@@ -490,11 +516,9 @@ Examples:
|
|
490
516
|
`["https://127.0.0.1:9200"]`
|
491
517
|
`["https://127.0.0.1:9200/mypath"]` (If using a proxy on a subpath)
|
492
518
|
|
493
|
-
Exclude
|
494
|
-
|
495
|
-
|
496
|
-
requests to the master nodes. This parameter should reference only data or
|
497
|
-
client nodes in Elasticsearch.
|
519
|
+
Exclude {ref}/modules-node.html[dedicated master nodes] from the `hosts` list to
|
520
|
+
prevent Logstash from sending bulk requests to the master nodes. This parameter
|
521
|
+
should reference only data or client nodes in Elasticsearch.
|
498
522
|
|
499
523
|
Any special characters present in the URLs here MUST be URL escaped! This means
|
500
524
|
`#` should be put in as `%23` for instance.
|
@@ -505,7 +529,8 @@ Any special characters present in the URLs here MUST be URL escaped! This means
|
|
505
529
|
* Value type is <<boolean,boolean>>
|
506
530
|
* Default value is `false`
|
507
531
|
|
508
|
-
Enable gzip compression on requests. Note that response compression is on by
|
532
|
+
Enable gzip compression on requests. Note that response compression is on by
|
533
|
+
default for Elasticsearch v5.0 and beyond
|
509
534
|
|
510
535
|
[id="plugins-{type}s-{plugin}-ilm_enabled"]
|
511
536
|
===== `ilm_enabled`
|
@@ -513,14 +538,19 @@ Enable gzip compression on requests. Note that response compression is on by def
|
|
513
538
|
* Value can be any of: `true`, `false`, `auto`
|
514
539
|
* Default value is `auto`
|
515
540
|
|
516
|
-
The default setting of `auto` will automatically enable
|
517
|
-
|
541
|
+
The default setting of `auto` will automatically enable
|
542
|
+
{ref}/index-lifecycle-management.html[Index Lifecycle Management], if the
|
543
|
+
Elasticsearch cluster is running Elasticsearch version `7.0.0` or higher with
|
544
|
+
the ILM feature enabled, and disable it otherwise.
|
518
545
|
|
519
|
-
Setting this flag to `false` will disable the Index Lifecycle Management
|
520
|
-
|
521
|
-
to enable Index Lifecycle Management
|
546
|
+
Setting this flag to `false` will disable the Index Lifecycle Management
|
547
|
+
feature, even if the Elasticsearch cluster supports ILM.
|
548
|
+
Setting this flag to `true` will enable Index Lifecycle Management feature, if
|
549
|
+
the Elasticsearch cluster supports it. This is required to enable Index
|
550
|
+
Lifecycle Management on a version of Elasticsearch earlier than version `7.0.0`.
|
522
551
|
|
523
|
-
NOTE: This feature requires a Basic License or above to be installed on an
|
552
|
+
NOTE: This feature requires a Basic License or above to be installed on an
|
553
|
+
Elasticsearch cluster version 6.6.0 or later.
|
524
554
|
|
525
555
|
[id="plugins-{type}s-{plugin}-ilm_pattern"]
|
526
556
|
===== `ilm_pattern`
|
@@ -528,17 +558,24 @@ NOTE: This feature requires a Basic License or above to be installed on an Elast
|
|
528
558
|
* Value type is <<string,string>>
|
529
559
|
* Default value is `{now/d}-000001`
|
530
560
|
|
531
|
-
Pattern used for generating indices managed by
|
532
|
-
|
561
|
+
Pattern used for generating indices managed by
|
562
|
+
{ref}/index-lifecycle-management.html[Index Lifecycle Management]. The value
|
563
|
+
specified in the pattern will be appended to the write alias, and incremented
|
564
|
+
automatically when a new index is created by ILM.
|
533
565
|
|
534
|
-
Date Math can be used when specifying an ilm pattern, see
|
566
|
+
Date Math can be used when specifying an ilm pattern, see
|
567
|
+
{ref}/indices-rollover-index.html#_using_date_math_with_the_rollover_api[Rollover
|
568
|
+
API docs] for details.
|
535
569
|
|
536
|
-
NOTE: Updating the pattern will require the index template to be rewritten
|
570
|
+
NOTE: Updating the pattern will require the index template to be rewritten.
|
537
571
|
|
538
|
-
NOTE: The pattern must finish with a dash and a number that will be automatically
|
572
|
+
NOTE: The pattern must finish with a dash and a number that will be automatically
|
573
|
+
incremented when indices rollover.
|
539
574
|
|
540
|
-
NOTE: The pattern is a 6-digit string padded by zeros, regardless of prior index name.
|
541
|
-
|
575
|
+
NOTE: The pattern is a 6-digit string padded by zeros, regardless of prior index name.
|
576
|
+
Example: 000001. See
|
577
|
+
{ref}/indices-rollover-index.html#rollover-index-api-path-params[Rollover path
|
578
|
+
parameters API docs] for details.
|
542
579
|
|
543
580
|
[id="plugins-{type}s-{plugin}-ilm_policy"]
|
544
581
|
===== `ilm_policy`
|
@@ -546,10 +583,12 @@ See {ref}/indices-rollover-index.html#rollover-index-api-path-params[Rollover pa
|
|
546
583
|
* Value type is <<string,string>>
|
547
584
|
* Default value is `logstash-policy`
|
548
585
|
|
549
|
-
Modify this setting to use a custom Index Lifecycle Management policy, rather
|
550
|
-
|
586
|
+
Modify this setting to use a custom Index Lifecycle Management policy, rather
|
587
|
+
than the default. If this value is not set, the default policy will be
|
588
|
+
automatically installed into Elasticsearch
|
551
589
|
|
552
|
-
NOTE: If this setting is specified, the policy must already exist in Elasticsearch
|
590
|
+
NOTE: If this setting is specified, the policy must already exist in Elasticsearch
|
591
|
+
cluster.
|
553
592
|
|
554
593
|
[id="plugins-{type}s-{plugin}-ilm_rollover_alias"]
|
555
594
|
===== `ilm_rollover_alias`
|
@@ -559,13 +598,17 @@ NOTE: If this setting is specified, the policy must already exist in Elasticsear
|
|
559
598
|
** ECS Compatibility disabled: `logstash`
|
560
599
|
** ECS Compatibility enabled: `ecs-logstash`
|
561
600
|
|
562
|
-
The rollover alias is the alias where indices managed using Index Lifecycle
|
601
|
+
The rollover alias is the alias where indices managed using Index Lifecycle
|
602
|
+
Management will be written to.
|
563
603
|
|
564
|
-
NOTE: If both `index` and `ilm_rollover_alias` are specified,
|
604
|
+
NOTE: If both `index` and `ilm_rollover_alias` are specified,
|
605
|
+
`ilm_rollover_alias` takes precedence.
|
565
606
|
|
566
|
-
NOTE: Updating the rollover alias will require the index template to be
|
607
|
+
NOTE: Updating the rollover alias will require the index template to be
|
608
|
+
rewritten.
|
567
609
|
|
568
|
-
NOTE: `ilm_rollover_alias` does NOT support dynamic variable substitution as
|
610
|
+
NOTE: `ilm_rollover_alias` does NOT support dynamic variable substitution as
|
611
|
+
`index` does.
|
569
612
|
|
570
613
|
[id="plugins-{type}s-{plugin}-index"]
|
571
614
|
===== `index`
|
@@ -580,8 +623,10 @@ The default value will partition your indices by day so you can more easily
|
|
580
623
|
delete old data or only search specific date ranges.
|
581
624
|
Indexes may not contain uppercase characters.
|
582
625
|
For weekly indexes ISO 8601 format is recommended, eg. logstash-%{+xxxx.ww}.
|
583
|
-
|
584
|
-
|
626
|
+
Logstash uses
|
627
|
+
http://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html[Joda
|
628
|
+
formats] for the index pattern from event timestamp.
|
629
|
+
|
585
630
|
|
586
631
|
[id="plugins-{type}s-{plugin}-keystore"]
|
587
632
|
===== `keystore`
|
@@ -653,8 +698,9 @@ Password to authenticate to a secure Elasticsearch cluster
|
|
653
698
|
* Value type is <<string,string>>
|
654
699
|
* There is no default value for this setting.
|
655
700
|
|
656
|
-
HTTP Path at which the Elasticsearch server lives. Use this if you must run
|
657
|
-
the root path for the Elasticsearch
|
701
|
+
HTTP Path at which the Elasticsearch server lives. Use this if you must run
|
702
|
+
Elasticsearch behind a proxy that remaps the root path for the Elasticsearch
|
703
|
+
HTTP API lives.
|
658
704
|
Note that if you use paths as components of URLs in the 'hosts' field you may
|
659
705
|
not also set this field. That will raise an error at startup
|
660
706
|
|
@@ -664,8 +710,10 @@ not also set this field. That will raise an error at startup
|
|
664
710
|
* Value type is <<string,string>>
|
665
711
|
* Default value is `nil`
|
666
712
|
|
667
|
-
Set which ingest pipeline you wish to execute for an event. You can also use
|
668
|
-
|
713
|
+
Set which ingest pipeline you wish to execute for an event. You can also use
|
714
|
+
event dependent configuration here like `pipeline =>
|
715
|
+
"%{[@metadata][pipeline]}"`. The pipeline parameter won't be set if the value
|
716
|
+
resolves to empty string ("").
|
669
717
|
|
670
718
|
[id="plugins-{type}s-{plugin}-pool_max"]
|
671
719
|
===== `pool_max`
|
@@ -716,7 +764,8 @@ to see if they have come back to life
|
|
716
764
|
* Value type is <<number,number>>
|
717
765
|
* Default value is `2`
|
718
766
|
|
719
|
-
Set initial interval in seconds between bulk retries. Doubled on each retry up
|
767
|
+
Set initial interval in seconds between bulk retries. Doubled on each retry up
|
768
|
+
to `retry_max_interval`
|
720
769
|
|
721
770
|
[id="plugins-{type}s-{plugin}-retry_max_interval"]
|
722
771
|
===== `retry_max_interval`
|
@@ -765,8 +814,9 @@ Example:
|
|
765
814
|
* Value type is <<string,string>>
|
766
815
|
* Default value is `"painless"`
|
767
816
|
|
768
|
-
Set the language of the used script.
|
769
|
-
When using indexed (stored) scripts on Elasticsearch 6 and higher, you must set
|
817
|
+
Set the language of the used script.
|
818
|
+
When using indexed (stored) scripts on Elasticsearch 6.0 and higher, you must set
|
819
|
+
this parameter to `""` (empty string).
|
770
820
|
|
771
821
|
[id="plugins-{type}s-{plugin}-script_type"]
|
772
822
|
===== `script_type`
|
@@ -801,9 +851,10 @@ if enabled, script is in charge of creating non-existent document (scripted upda
|
|
801
851
|
* Value type is <<boolean,boolean>>
|
802
852
|
* Default value is `false`
|
803
853
|
|
804
|
-
This setting asks Elasticsearch for the list of all cluster nodes and adds them
|
805
|
-
|
806
|
-
For Elasticsearch 5.x and 6.x any nodes with `http.enabled` (on by default) will
|
854
|
+
This setting asks Elasticsearch for the list of all cluster nodes and adds them
|
855
|
+
to the hosts list.
|
856
|
+
For Elasticsearch 5.x and 6.x any nodes with `http.enabled` (on by default) will
|
857
|
+
be added to the hosts list, excluding master-only nodes.
|
807
858
|
|
808
859
|
[id="plugins-{type}s-{plugin}-sniffing_delay"]
|
809
860
|
===== `sniffing_delay`
|
@@ -830,9 +881,11 @@ do not use full URL here, only paths, e.g. "/sniff/_nodes/http"
|
|
830
881
|
* Value type is <<boolean,boolean>>
|
831
882
|
* There is no default value for this setting.
|
832
883
|
|
833
|
-
Enable SSL/TLS secured communication to Elasticsearch cluster. Leaving this
|
834
|
-
is specified in the URLs listed in 'hosts'.
|
835
|
-
If
|
884
|
+
Enable SSL/TLS secured communication to Elasticsearch cluster. Leaving this
|
885
|
+
unspecified will use whatever scheme is specified in the URLs listed in 'hosts'.
|
886
|
+
If no explicit protocol is specified plain HTTP will be used. If SSL is
|
887
|
+
explicitly disabled here the plugin will refuse to start if an HTTPS URL is
|
888
|
+
given in 'hosts'
|
836
889
|
|
837
890
|
[id="plugins-{type}s-{plugin}-ssl_certificate_verification"]
|
838
891
|
===== `ssl_certificate_verification`
|
@@ -937,14 +990,16 @@ Username to authenticate to a secure Elasticsearch cluster
|
|
937
990
|
* Value type is <<number,number>>
|
938
991
|
* Default value is `10000`
|
939
992
|
|
940
|
-
How long to wait before checking
|
941
|
-
|
942
|
-
|
943
|
-
|
944
|
-
|
945
|
-
|
946
|
-
|
947
|
-
|
993
|
+
How long to wait before checking for a stale connection to determine if a keepalive request is needed.
|
994
|
+
Consider setting this value lower than the default, possibly to 0, if you get connection errors regularly.
|
995
|
+
|
996
|
+
This client is based on Apache Commons. Here's how the
|
997
|
+
https://hc.apache.org/httpcomponents-client-ga/httpclient/apidocs/org/apache/http/impl/conn/PoolingHttpClientConnectionManager.html#setValidateAfterInactivity(int)[Apache
|
998
|
+
Commons documentation] describes this option: "Defines period of inactivity in
|
999
|
+
milliseconds after which persistent connections must be re-validated prior to
|
1000
|
+
being leased to the consumer. Non-positive value passed to this method disables
|
1001
|
+
connection validation. This check helps detect connections that have become
|
1002
|
+
stale (half-closed) while kept inactive in the pool."
|
948
1003
|
|
949
1004
|
[id="plugins-{type}s-{plugin}-version"]
|
950
1005
|
===== `version`
|
@@ -952,8 +1007,10 @@ See https://hc.apache.org/httpcomponents-client-ga/httpclient/apidocs/org/apache
|
|
952
1007
|
* Value type is <<string,string>>
|
953
1008
|
* There is no default value for this setting.
|
954
1009
|
|
955
|
-
The version to use for indexing. Use sprintf syntax like `%{my_version}` to use
|
956
|
-
See
|
1010
|
+
The version to use for indexing. Use sprintf syntax like `%{my_version}` to use
|
1011
|
+
a field value here. See the
|
1012
|
+
https://www.elastic.co/blog/elasticsearch-versioning-support[versioning support
|
1013
|
+
blog] for more information.
|
957
1014
|
|
958
1015
|
[id="plugins-{type}s-{plugin}-version_type"]
|
959
1016
|
===== `version_type`
|
@@ -961,10 +1018,10 @@ See https://www.elastic.co/blog/elasticsearch-versioning-support.
|
|
961
1018
|
* Value can be any of: `internal`, `external`, `external_gt`, `external_gte`, `force`
|
962
1019
|
* There is no default value for this setting.
|
963
1020
|
|
964
|
-
The version_type to use for indexing.
|
965
|
-
|
966
|
-
|
967
|
-
|
1021
|
+
The version_type to use for indexing. See the
|
1022
|
+
https://www.elastic.co/blog/elasticsearch-versioning-support[versioning support
|
1023
|
+
blog] and {ref}/docs-index_.html#_version_types[Version types] in the
|
1024
|
+
Elasticsearch documentation.
|
968
1025
|
|
969
1026
|
|
970
1027
|
[id="plugins-{type}s-{plugin}-common-options"]
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-output-elasticsearch
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 10.8.
|
4
|
+
version: 10.8.2
|
5
5
|
platform: java
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2021-01-19 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|