Skip to content
Documentation
APP - CMT Monitoring
Outputs

Outputs

An output is one configured destination for check results. cli always runs; every other output type only runs when the invocation is --report/--cron (see Options). --dryrun builds a payload without sending it; --debug prints the payload and, when one is sent, the backend’s response - handy for previewing any of these without a live backend:

cmt --report --dryrun --debug    # payload only, nothing leaves the host
cmt --report --debug             # payload + what the backend answered
cmt --report --debug --verbose   # ... and an indented copy of each

--debug prints a payload exactly as it goes on the wire, so what you read is what the backend receives. Add --verbose for an indented, easier-to-read copy printed after it.

An output entry’s type-specific fields sit directly at the top level of the outputs: entry (not nested under a conf: key, unlike checks:):

outputs:
  - name: cli          # arbitrary label
    type: cli           # registered output type
    format: short

Fields common to every HTTP-based output

graylog_http_gelf, elasticsearch/opensearch, and influxdb all share:

Field Meaning
ssl_skipverify overrides global.ssl_skipverify for this output
http_proxy proxy URL, or noenv to ignore HTTP_PROXY/HTTPS_PROXY
username / password HTTP basic auth
token sent verbatim as the Authorization header (no Bearer /Token prefix added - include it in the value yourself, e.g. token: "Bearer xxx"); takes priority over username/password
timeout overrides global.timeout for this output
prefix prepended to every non-identity field name
fieldmap per-output field renames, checked before global.fieldmap

Renaming fields (fieldmap)

fieldmap renames the fields an output ships, so results can match a naming convention your backend already expects. Set it per output, or once in global for every output:

global:
  fieldmap:
    node: host                 # applies to every output
    cpu: cpu_percent

outputs:
  - name: es1
    type: elasticsearch
    url: https://es.example.com:9200/_bulk
    fieldmap:
      timestamp: "@timestamp"   # this output only
      node: hostname            # wins over global.fieldmap's "host"

With the above, es1 ships @timestamp, hostname and cpu_percent; every other output ships timestamp, host and cpu_percent.

A few things worth knowing:

  • A per-output fieldmap wins field by field. Fields it doesn’t mention still follow global.fieldmap.
  • Renames don’t chain: global.fieldmap can’t rename a name a per-output fieldmap just produced.
  • prefix is added after the rename, so prefix: cmt_ plus node: host gives cmt_host.

Renameable: message, source, key, group, env, node, module, check, state, severity, every item a check produces (including tag_* items from global.tags/conf.tags), plus timestamp on elasticsearch/opensearch. Run cmt --report --dryrun --debug to see the exact names an output ships.

A per-call circuit breaker skips the rest of a batch once one send fails outright (connection/DNS-level, not just a mismatched http_code) - most relevant to graylog_gelf_udp/graylog_http_gelf, which send one message per result with no bulk mode; elasticsearch/influxdb already send a whole run in one request.

Registered types