Elasticsearch
Official · maintained by Marmotmarmotdata/elasticsearch Discover indices, data streams, and aliases from Elasticsearch clusters
The Elasticsearch plugin discovers indices, data streams and aliases from Elasticsearch clusters.
Required Permissions
The connecting user needs monitor cluster privilege and view_index_metadata on indices. The built-in viewer role is usually sufficient.
In the UI
Point-and-click, no config file needed.
- 1 Open Runs Create pipeline
- 2 Pick Elasticsearch from the plugin list.
- 3 Fill in the wizard, set a schedule, save.
With the CLI
Save a YAML config, then run marmot ingest.
name: my-elasticsearch-pipeline
runs:
- elasticsearch:
# No required fields — see the Configuration tab.$ marmot ingest -c ingest.yamlNot using plugins? Other ways to populate Marmot
Configuration
14 top-level fields. * marks required fields.
tags multiselect Tags to apply to discovered assets
external_links object[] External links to show on all assets
name string Display name for the link
icon string Icon identifier for the link
url string URL to the external resource
filter object Filter discovered assets by name (regex)
include multiselect Include patterns for resource names (regex)
exclude multiselect Exclude patterns for resource names (regex)
addresses multiselect List of Elasticsearch node URLs
cloud_id string Elastic Cloud ID for connecting to Elastic Cloud
username string Username for basic authentication
password password Password for basic authentication
api_key password API key for authentication (mutually exclusive with username/password)
tls_skip_verify bool Skip TLS certificate verification
- default
- false
ca_cert_path string Path to a custom CA certificate file
include_data_streams bool Discover data streams
- default
- true
include_aliases bool Discover aliases
- default
- true
include_index_stats bool Collect document count and store size metrics
- default
- true
include_system_indices bool Include system indices (prefixed with .)
- default
- false
Assets emitted
Metadata this plugin attaches to each discovered asset.
Index
IndexFieldsIndexFields represents Elasticsearch index metadata fields.
cluster stringName of the Elasticsearch cluster
index_name stringName of the index
health stringHealth status of the index (green, yellow, red)
status stringOpen/close status of the index
uuid stringUUID of the index
shards intNumber of primary shards
replicas intNumber of replica shards
docs_count intNumber of documents in the index
store_size stringTotal store size of the index
creation_date stringDate and time when the index was created
Data Stream
DataStreamFieldsDataStreamFields represents Elasticsearch data stream metadata fields.
data_stream_name stringName of the data stream
timestamp_field stringName of the timestamp field
backing_indices intNumber of backing indices
generation intCurrent generation of the data stream
status stringHealth status of the data stream
ilm_policy stringILM policy applied to the data stream
template stringIndex template used by the data stream
Alias
AliasFieldsAliasFields represents Elasticsearch alias metadata fields.
alias_name stringName of the alias
indices stringComma-separated list of indices the alias points to
is_write_index stringWhether the alias has a designated write index
filter_defined stringWhether a filter is defined on the alias