Skip to content

Vector by Helm with sink to ElasticSearch

Goal: create dynamic index name in Elastic

# ....
combine_index_name:
  type: remap
  inputs:
    - "vector"
  source: |
    .metadata_index_name="unknown"

    if exists(.kubernetes.pod_namespace) {
      .metadata_index_name = to_string!(.kubernetes.pod_namespace)
    }

# ....

sinks:
  elastic-good:
    type: elasticsearch
    inputs: ["output_data"]
    endpoints: ["https://elasticsearch-master.logs.svc.cluster.local:9200"]
    auth:
      strategy: basic
      user: ${VECTOR_USERNAME}
      password: ${VECTOR_PASSWORD}
    tls:
      verify_certificate: false
    bulk:
      action: index
      # THIS IS IT !
      index: '{{ "{{ .metadata_index_name }}" }}.%Y-%m'
    mode: bulk
    encoding:
      except_fields:
        - metadata_index_name
    buffer:
      type: memory
      max_events: 10000
      when_full: block