Skip to content
Documentation
APP - CMT Monitoring
Outputs
elasticsearch / opensearch

elasticsearch / opensearch

Use case

Index every result as a JSON document, for dashboards/alerting in Elasticsearch or OpenSearch. opensearch is registered as an alias of the exact same implementation (wire-compatible bulk/index APIs) - use whichever type: matches your cluster, the fields are identical.

Configuration 

outputs:
  - name: es1
    type: elasticsearch          # or: opensearch
    url: https://es.example.com:9200/_bulk    # the full endpoint
    index: cmt                   # default "cmt"
    #index: "cmt-%Y.%m.%d"       # strftime directives rotate the index (daily, here)
    http_code: 200                # expected status, 0 = don't check

    # auth - security plugin/basic auth:
    username: cmt
    password: xxxxxxx
    # or an API key instead (takes priority over username/password if both set):
    #token: "ApiKey xxxxxxxxxxxxxxxx=="   # the literal word "ApiKey" is part of the value

    #ssl_skipverify: false        # overrides global.ssl_skipverify for this output
    #http_proxy: ""                # proxy URL, or "noenv" to ignore HTTP_PROXY/HTTPS_PROXY

No auth (open cluster, e.g. local dev): omit both username/password and token.

index: always runs through strftime substitution (not Go’s own time.Format layout) - a literal name with no % in it passes through unchanged. token (if set) is sent verbatim as the Authorization header - no prefix added for you.

URL and the $$$ placeholder

url: is the full _bulk endpoint - _bulk is never appended for you.

Write $$$ anywhere in it and it is replaced by the resolved index:. That is what lets a rotating index name live in the URL path while query parameters stay intact - an ingest pipeline, for instance:

outputs:
  - name: es1
    type: elasticsearch
    url: "https://es.example.com:9200/$$$/_bulk?pipeline=cmt-ingest"
    index: "cmt-%Y.%m.%d"

sends to https://es.example.com:9200/cmt-2026.01.31/_bulk?pipeline=cmt-ingest.

$$$ is optional: index: is sent with every document regardless, so a plain https://es.example.com:9200/_bulk indexes exactly the same results.

Upgrading from cmt 4.0: a url: that was a bare base address (https://es.example.com:9200) needs /_bulk added. cmt prints a warning when url: has no _bulk in its path, and sends it unchanged.

Renaming timestamp

fieldmap renames any field in the document, including this output’s timestamp - handy when the index template expects @timestamp:

outputs:
  - name: es1
    type: elasticsearch
    url: https://es.example.com:9200/_bulk
    fieldmap:
      timestamp: "@timestamp"

See fields common to every HTTP-based output for the rest (timeout, prefix, fieldmap).

Output

One document per result, indexed via the _bulk API (the whole run in one POST). Every result contributes: timestamp, message, source (group.env.node), key (group.node.module.check), group, env, node, module, check, one field per CheckItem, state, severity - see Configuration for the identity fields (node/group/env).

Example 

cmt --report --output es1
cavaliba_apiinfluxdb