Elasticsearch

Vector batches data and flushes it to Elasticsearch's _bulk API endpoint. By default, all events are inserted via the index action, which replaces documents if an existing one has the same id. If bulk_action is configured with create, Elasticsearch does not replace an existing document and instead returns a conflict error.

By default, Vector uses the index action with Elasticsearch's Bulk API. To use Data streams, set the mode to data_stream. Use the combination of data_stream.type, data_stream.dataset and data_stream.namespace instead of index.

By default, Elasticsearch allows partial bulk ingestion failures. This is typically due to Elasticsearch index mapping errors, where data keys aren't consistently typed. To change this behavior, refer to the Elasticsearch ignore_malformed setting.

This component is stateless, meaning its behavior is consistent across each input.

Health checks ensure that the downstream service is accessible and ready to accept data. This check is performed upon sink initialization. If the health check fails an error will be logged and Vector will proceed to start.

Vector supports dynamic configuration values through a simple template syntax. If an option supports templating, it will be noted with a badge and you can use event fields to create dynamic values. For example:

[sinks.my-sink]
dynamic_option = "application={{ application_id }}"

In the above example, the application_id for each event will be used to partition outgoing data.

Vector uses OpenSSL for TLS protocols due to OpenSSL's maturity. You can enable and adjust TLS behavior using the tls.* options.

This component buffers & batches data as shown in the diagram above. You'll notice that Vector treats these concepts differently, instead of treating them as global concepts, Vector treats them as sink specific concepts. This isolates sinks, ensuring services disruptions are contained and delivery guarantees are honored.

Batches are flushed when 1 of 2 conditions are met:

1. The batch age meets or exceeds the configured timeout_secs.
2. The batch size meets or exceeds the configured max_size or max_events.

Buffers are controlled via the buffer.* options.

Vector checks for AWS credentials in the following order:

1. The access_key_id and secret_access_key options.
2. The AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.
3. The credential_process command in the AWS config file (usually located at ~/.aws/config).
4. The AWS credentials file (usually located at ~/.aws/credentials).
5. The IAM instance profile (only works if running on an EC2 instance with an instance profile/role).

If no credentials are found, Vector's health check fails and an error is logged. If your AWS credentials expire, Vector will automatically search for up-to-date credentials in the places (and order) described above.

Vector will retry failed requests (status == 429, >= 500, and != 501). Other responses will not be retried. You can control the number of retry attempts and backoff rate with the request.retry_attempts and request.retry_backoff_secs options.