Elasticsearch bulk

Re-point an existing Elasticsearch shipper without changing it.

Logstreem accepts the Elasticsearch _bulk format. Anything that ships to Elasticsearch — Logstash, Filebeat, an application client — can ship here by changing a URL.

curl -X POST https://api.logstreem.com/v1/elastic/_bulk \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/x-ndjson" \
  --data-binary $'{"index":{"_index":"api-gateway-prod"}}\n{"level":"error","service":"checkout","status":503}\n'

What is different

Elasticsearch	Here
`_index`	The dataset name
`_id`	Ignored — there is no document identity to update
`update` / `delete` actions	Rejected. Events are immutable
Mappings and templates	Not needed — schema on read
`@timestamp`	Read as `_time` automatically

This is a migration path, not a destination

The bulk endpoint exists so you can move without a rewrite, in an afternoon. Once you are here, sending native JSON is simpler and slightly faster.

PreviousKafka NextLSQL