Skip to main content

​
Supported data types:

📘 Logs

​
Configuration

FieldTypeDefaultRequiredDescription
NameStringnonetrueUnique identifier within Sawmills.
EndpointStringnonetrueThe target Elasticsearch URL to which data will be sent. If multiple endpoints are added, they will be attempted in round-robin order.
Cloud IDStringnonetrueThe Elastic Cloud ID of the Elastic Cloud Cluster to which data will be sent.
Enable Basic AuthBooleanfalsetrueChoose how to provide Elasticsearch credentials: via HTTP Basic Auth using a username and password or Elasticsearch API Key. Select ‘None’ to use your cluster’s authentication configuration.
UsernameStringnonetrueUsername when using basic authentication.
PasswordStringnonetruePassword when using basic authentication.
API KeyStringnonetrueElasticsearch API Key in “encoded” format, when using API Key authentication.

​
Advanced Options

FieldTypeDefaultRequiredDescription
Logs IndexStringnonefalseThe index or data stream name to publish logs to. Logs Index should be empty unless all logs should be sent to the same index.
Mapping ModeRadioECStrueDetermines how OpenTelemetry data is mapped to Elasticsearch index documents. The ‘OTel’ mapping mode requires Elasticsearch 8.12 or above.

​
Logstash Index Configuration

The Elasticsearch exporter supports dynamic index configuration through Logstash. You can specify the target index for your logs using the elasticsearch.index field in your Logstash configuration.

​
Example Logstash Configuration

if [cluster] == "staging-cluster" {
  mutate {
    add_field => {
      "elasticsearch.index" => "staging-cluster-%{+YYYY.MM.dd}"
    }
  }
}
In this example:
  • The exporter will use the elasticsearch.index attribute to determine the target index
  • The index name can include dynamic date patterns (e.g., %{+YYYY.MM.dd})
  • You can use any Logstash condition to set different indices based on your requirements

​
Notes

  • If elasticsearch.index is not set, the exporter will use the default index configuration
  • The index name must follow Elasticsearch naming conventions
  • Date patterns in the index name will be evaluated at the time of sending the logs