OpenSearch

OpenSearch (open-search)

Bulk-index events into OpenSearch clusters, including AWS-managed variants.

Search json

Minimal example

output:
  open-search:
    common: {}

JSON

{
  "output": {
    "open-search": {
      "common": {}
    }
  }
}

Contents

• Minimal example

• Fields

• Schema

Fields

Field	Type	Required	Description
common	Common	✅	Shared OpenSearch connection and indexing options Shared configuration applied to all OpenSearch outputs.

Schema

• Common - Retry Fields
• Common - Batch Fields
• Common - Auth - Basic Fields
• Common - Auth - Api Key Fields
• Common - Auth - Tls Fields
• Common - Auth Fields
• Common - Aws Fields
• Common - Data Stream Fields
• Common Fields
• Common - Headers Table
• Common - Query Table
• Common - Mode Options
• Common - Op Type Options

Common - Retry Fields

Field	Type	Required	Description
timeout	time-interval (string)	✅	timeout (e.g. 500ms, 2s etc. - default is 30). Examples: 500ms, 2h
retries	number (integer)		number of retries. Examples: 42, 1.2e-10

Common - Batch Fields

Field	Type	Required	Description
uuid-field	field (string)		Field where generated uuid, the unique marker for the group, will be stored. Examples: data_field
invocation-time-field	field (string)		Field where invocation time will be stored. Examples: data_field
completion-time-field	field (string)		Field where completion (end of execution) time will be stored. Examples: data_field
begin-marker-field	field (string)		Field used to mark first event in the group. Examples: data_field
end-marker-field	field (string)		Field used to mark last event in the group. Examples: data_field
line-count-field	field (string)		Field used to store the line count of the batch. Examples: data_field
line-num-field	field (string)		Field used to store the line number of the batch. Examples: data_field

Common - Auth - Basic Fields

Field	Type	Required	Description
username	string
password	string

Common - Auth - Api Key Fields

Field	Type	Required	Description
id	string
key	string
base64	string

Common - Auth - Tls Fields

Field	Type	Required	Description
ca-certificate	string		PEM encoded CA certificate bundle.
client-certificate	string		PEM encoded client certificate for mutual TLS.
client-key	string		PEM encoded private key for mutual TLS.
insecure-skip-verify	boolean (bool)		Skip TLS certificate verification (development only).

Common - Auth Fields

Field	Type	Required	Description
basic	Basic
api-key	Api Key
bearer-token	string
tls	Tls

Common - Aws Fields

Field	Type	Required	Description
region	string	✅	AWS region used for request signing.
service	string		Override AWS service name (default es).
profile	string		Optional shared credentials profile.
role-arn	string		AssumeRole ARN for federated access.
session-name	string		Session name when assuming roles.
access-key-id	string		Access key used for signing requests.
secret-access-key	string		Secret key used for signing requests.
session-token	string		Optional session token for temporary credentials.

Common - Data Stream Fields

Field	Type	Required	Description
r-type	string	✅	Data stream type (logs, metrics, traces).
dataset	string	✅	Data stream dataset (e.g. service.application).
namespace	string	✅	Data stream namespace (e.g. prod, staging).

Common Fields

Field	Type	Required	Description
retry	Retry		Retry policy for bulk failures.
batch	Batch		Logical batching hints shared with other outputs.
endpoint	url (string)		HTTPS endpoint for the cluster (required when cloud-id is unset). Examples: https://example.com/path
cloud-id	string		Elastic Cloud / Serverless Cloud ID (mutually exclusive with endpoint).
region	string		Optional default region used for auth helpers and logging.
auth	Auth		Authentication strategies (basic, API keys, bearer).
aws	Aws		AWS SigV4 credentials for managed OpenSearch/Elasticsearch.
mode	Mode		Indexing lifecycle mode (classic index vs data stream). Allowed values: classic-index, data-stream
index	string		Static index/alias target when mode=classic-index.
index-field	field (string)		Event field that provides the target index/alias. Examples: data_field
index-pointer	json-pointer (string)		JSON pointer resolving to the index/alias.
data-stream	Data Stream		Data stream configuration when mode=data-stream.
document-id-field	field (string)		Event field containing the document _id. Examples: data_field
document-id-pointer	json-pointer (string)		JSON pointer resolving to the document _id.
document-id-expression	string		Expression used to compute the document _id.
routing-field	field (string)		Event field providing custom routing key. Examples: data_field
routing-pointer	json-pointer (string)		JSON pointer providing custom routing key.
routing-expression	string		Expression computing the routing key.
pipeline	string		Optional ingest pipeline to apply server-side.
op-type	Op Type		Bulk operation type for each event. Allowed values: index, create, update, delete
retry-on-conflict	number (integer)		Retry on conflict (for update/upsert operations). Examples: 42, 1.2e-10
refresh	boolean (bool)		Force refresh after each batch.
gzip	boolean (bool)		Compress bulk payloads with gzip.
input-field	field (string)		Event field containing the JSON document payload. Examples: data_field
input-pointer	json-pointer (string)		JSON pointer for extracting the payload.
payload-template	string		Template expression to render the payload when not using event body.
headers	map (string)		Additional HTTP headers forwarded with each request.
query	map (string)		Static query parameters appended to bulk requests.
request-timeout-secs	number (integer)		Request timeout in seconds. Examples: 42, 1.2e-10
connect-timeout-secs	number (integer)		Connect timeout in seconds. Examples: 42, 1.2e-10

Common - Headers Table

Header	Value
Header-Name	value

Value format: templated-text.

Common - Query Table

Parameter	Value
param	value

Value format: templated-text.

Common - Mode Options

Value	Description
classic-index	Standard index or alias writes
data-stream	Data stream aware writes (auto-selects stream based on dataset/namespace)

Common - Op Type Options

Value	Description
index	Index (create or replace) each document
create	Only create new documents; fail if _id exists
update	Update existing documents (requires partial document or script)
delete	Delete documents (requires _id)