You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: exporter/elasticsearchexporter/README.md
+16-8Lines changed: 16 additions & 8 deletions
Original file line number
Diff line number
Diff line change
@@ -119,19 +119,17 @@ Using the common `batcher` functionality provides several benefits over the defa
119
119
### Elasticsearch document routing
120
120
121
121
Documents are statically or dynamically routed to the target index / data stream in the following order. The first routing mode that applies will be used.
122
-
1. "Static mode": To `logs_index` for log records, `metrics_index` for data points and `traces_index` for spans, if these configs are not empty respectively. In OTel mapping mode (`mapping::mode: otel`), span events are separate documents routed to `logs_index` if non-empty.
123
-
2. "Dynamic - Index attribute mode": To index name in `elasticsearch.index` attribute (precedence: log record / data point / span attribute [^3] > scope attribute > resource attribute) if the attribute exists. In OTel mapping mode (`mapping::mode: otel`), span events are separate documents routed according to span events attributes, not span attributes.
122
+
1. "Static mode": To `logs_index` for log records, `metrics_index` for data points and `traces_index` for spans, if these configs are not empty respectively. [^3]
123
+
2. "Dynamic - Index attribute mode": To index name in `elasticsearch.index` attribute (precedence: log record / data point / span attribute > scope attribute > resource attribute) if the attribute exists. [^3]
124
124
3. "Dynamic - Data stream routing mode": To data stream constructed from `${data_stream.type}-${data_stream.dataset}-${data_stream.namespace}`,
125
-
where `data_stream.type` is `logs` for log records, `metrics` for data points, and `traces` for spans.
126
-
In OTel mapping mode (`mapping::mode: otel`), span events are separate documents that have `data_stream.type: logs` and are routed using span event attributes, not span attributes.
127
-
Note that in OTel mapping mode, `data_stream.dataset` will always be appended with `.otel`.
125
+
where `data_stream.type` is `logs` for log records, `metrics` for data points, and `traces` for spans, and is static. [^3]
128
126
In a special case with `mapping::mode: bodymap`, `data_stream.type` field (valid values: `logs`, `metrics`) can be dynamically set from attributes.
129
-
The resulting docs will contain the corresponding `data_stream.*` fields, see restrictions applied to [Data Stream Fields](https://www.elastic.co/guide/en/ecs/current/ecs-data_stream.html).
130
-
1. `data_stream.dataset` or `data_stream.namespace` in attributes (precedence: log record / data point / span attribute [^3] > scope attribute > resource attribute)
127
+
The resulting documents will contain the corresponding `data_stream.*` fields, see restrictions applied to [Data Stream Fields](https://www.elastic.co/guide/en/ecs/current/ecs-data_stream.html).
128
+
1. `data_stream.dataset` or `data_stream.namespace` in attributes (precedence: log record / data point / span attribute > scope attribute > resource attribute)
131
129
2. Otherwise, if scope name matches regex `/receiver/(\w*receiver)`, `data_stream.dataset` will be capture group #1
132
130
3. Otherwise, `data_stream.dataset` falls back to `generic` and `data_stream.namespace` falls back to `default`.
133
131
134
-
[^3]: Additionally, span event attribute in OTel mode
132
+
[^3]: See additional handling in [Document routing exceptions for OTel data mode](#document-routing-exceptions-for-otel-data-mode)
135
133
136
134
This can be customised through the following settings:
137
135
@@ -160,6 +158,16 @@ This can be customised through the following settings:
160
158
- `logs_dynamic_id` (optional): Dynamically determines the document ID to be used in Elasticsearch based on a log record attribute.
161
159
- `enabled`(default=false): Enable/Disable dynamic ID for log records. If `elasticsearch.document_id` exists and is not an empty string in the log record attributes, it will be used as the document ID. Otherwise, the document ID will be generated by Elasticsearch. The attribute `elasticsearch.document_id` is removed from the final document. See [Setting a document id dynamically](#setting-a-document-id-dynamically).
162
160
161
+
#### Document routing exceptions for OTel data mode
162
+
163
+
In OTel mapping mode (`mapping::mode: otel`), there are certain exceptions to the above document routing rules in [Elasticsearch document routing](#elasticsearch-document-routing).
164
+
165
+
1. "Static mode": span events are separate documents routed to `logs_index` if non-empty.
166
+
2. "Dynamic - Index attribute mode": span events are separate documents routed using attribute (precedence: span event attribute > scope attribute > resource attribute)
167
+
3. "Dynamic - Data stream routing mode": Span events are separate documents that have `data_stream.type: logs` and are routed using attribute (precedence: span event attribute > scope attribute > resource attribute)
168
+
For all documents, `data_stream.dataset` will always be appended with `.otel`.
169
+
170
+
163
171
### Elasticsearch document mapping
164
172
165
173
The Elasticsearch exporter supports several document schemas and preprocessing
0 commit comments