Elasticsearch Source

Supported Data Types

📘 Logs

Configuration

Field	Type	Default	Required	Description
Name	String	none	true	Unique identifier within Sawmills.
Address	String	`${env:MY_POD_IP}`	true	The address (IP or hostname) to receive Elasticsearch data.
Port	Int	9200	true	The port on which Elasticsearch data is received.

Advanced Options

Field	Type	Default	Required	Description
Fallback Endpoint	String	none	false	Optional fallback endpoint for Elasticsearch data reception. When the primary endpoint is unavailable, data will be routed to this fallback endpoint.

The pod’s IP address is retrieved by defining an environment variable MY_POD_IP from the pod’s status field status.podIP. You can access this value using ${env:MY_POD_IP} in your configuration to dynamically reference the pod’s IP at runtime.

Usage

The Elasticsearch source allows you to receive log data from Elasticsearch clusters. This source is specifically designed to handle log data ingestion and supports the standard Elasticsearch communication protocols & from Logstash.

⌘I

Overview

Sawmills Agent

Collectors

Pipelines

Processors

Live Logs

Data Insights

Analytics Dashboard

How To Guides

Integrations

CLI

MCP

Administration

Elasticsearch Source

Supported Data Types

Configuration

Advanced Options

Usage

​Supported Data Types

​Configuration

​Advanced Options

​Usage

Supported Data Types

Configuration

Advanced Options

Usage