Elasticsearch bulk (Beats, Logstash, Fluentd)
Embed
<a href="https://forumulate.com/p/watchtower/docs/elasticsearch"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/ddc89c23-caa5-42b2-840b-1f089fc5878a/social-card.svg?v=3e7ae33eec8b" alt="Elasticsearch bulk (Beats, Logstash, Fluentd)" width="600" height="315"></a>Configure the Elasticsearch output of Filebeat, Logstash or Fluentd with the gateway as the host. Needs an ingestion key with ingest:logs, sent as Authorization: ApiKey <key>, as the Basic password, or as Bearer.
POST /_bulk
POST /{index}/_bulk
GET /NDJSON action/document pairs; only index and create are stored, other actions get a per-item 400. @timestamp, message, log.level, service.name and host.name are mapped; every other field becomes an attribute with nested objects flattened by .. The answer mirrors Elasticsearch (took, errors, one items entry per action with 201 or 400). GET / answers a minimal banner (version 8.11.0) so the clients' startup probe passes. Disable index-template and ILM setup in the client; the gateway has no such APIs.
Delivery is at-least-once. Do not set wt.* fields; the gateway deletes them.
Status: structure-checked, not yet run against a real Beats or Logstash.