Outputs
An output is one configured destination for check results. cli
always runs; every other output type only runs when the invocation is
--report/--cron (see Options). --dryrun
builds a payload without sending it; --debug prints the constructed
payload - handy for previewing any of these without a live backend:
cmt --report --dryrun --debugAn output entry’s type-specific fields sit directly at the top level of the
outputs: entry (not nested under a conf: key, unlike checks:):
outputs:
- name: cli # arbitrary label
type: cli # registered output type
format: shortFields common to every HTTP-based output
graylog_http_gelf, elasticsearch/opensearch, and influxdb all share:
| Field | Meaning |
|---|---|
ssl_skipverify |
overrides global.ssl_skipverify for this output |
http_proxy |
proxy URL, or noenv to ignore HTTP_PROXY/HTTPS_PROXY |
username / password |
HTTP basic auth |
token |
sent verbatim as the Authorization header (no Bearer /Token prefix added - include it in the value yourself, e.g. token: "Bearer xxx"); takes priority over username/password |
timeout |
overrides global.timeout for this output |
prefix |
prepended to every non-identity field name |
fieldmap |
per-output field renames, checked before global.fieldmap |
A per-call circuit breaker skips the rest of a batch once one send fails
outright (connection/DNS-level, not just a mismatched http_code) - most
relevant to graylog_gelf_udp/graylog_http_gelf, which send one message
per result with no bulk mode; elasticsearch/influxdb already send a
whole run in one request.
Registered types
- cli - the terminal/log output, always on
- cavaliba_api - POST results back to Cavaliba (
app_cmt) - elasticsearch / opensearch
- influxdb
- graylog_gelf_udp
- graylog_http_gelf