elasticsearch / opensearch

Use case

Index every result as a JSON document, for dashboards/alerting in Elasticsearch or OpenSearch. opensearch is registered as an alias of the exact same implementation (wire-compatible bulk/index APIs) - use whichever type: matches your cluster, the fields are identical.

Configuration

outputs:
  - name: es1
    type: elasticsearch          # or: opensearch
    url: https://es.example.com:9200
    index: cmt                   # default "cmt"
    #index: "cmt-%Y.%m.%d"       # strftime directives rotate the index (daily, here)
    http_code: 200                # expected status, 0 = don't check

    # auth - security plugin/basic auth:
    username: cmt
    password: xxxxxxx
    # or an API key instead (takes priority over username/password if both set):
    #token: "ApiKey xxxxxxxxxxxxxxxx=="   # the literal word "ApiKey" is part of the value

    #ssl_skipverify: false        # overrides global.ssl_skipverify for this output
    #http_proxy: ""                # proxy URL, or "noenv" to ignore HTTP_PROXY/HTTPS_PROXY

No auth (open cluster, e.g. local dev): omit both username/password and token.

index: always runs through strftime substitution (not Go’s own time.Format layout) - a literal name with no % in it passes through unchanged. token (if set) is sent verbatim as the Authorization header - no prefix added for you. See fields common to every HTTP-based output for the rest (timeout, prefix, fieldmap).

Output

One document per result, indexed via the _bulk API (the whole run in one POST). Every result contributes: timestamp, message, source (group.env.node), key (group.node.module.check), group, env, node, module, check, one field per CheckItem, state, severity - see Configuration for the identity fields (node/group/env).

Example

cmt --report --output es1