Add notice on timestamp field renaming in the data_stream mode of Ela…

…sticsearch sink Signed-off-by: Up Neck <[email protected]>
vectordotdev · Jan 17, 2025 · 2dac288 · 2dac288
1 parent aaa54ec
commit 2dac288
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/src/sinks/elasticsearch/mod.rs b/src/sinks/elasticsearch/mod.rs
@@ -68,6 +68,9 @@ pub enum ElasticsearchMode {
     /// Ingests documents in bulk, using the bulk API `create` action.
     ///
     /// Elasticsearch Data Streams only support the `create` action.
+    /// 
+    /// If the mode is set to `data_stream` and a `timestamp` field is present in a message,
+    /// Vector renames this field to the expected `@timestamp` to comply with the Elastic Common Schema.
     DataStream,
 }
 

diff --git a/website/cue/reference/components/sinks/base/elasticsearch.cue b/website/cue/reference/components/sinks/base/elasticsearch.cue
@@ -572,6 +572,9 @@ base: components: sinks: elasticsearch: configuration: {
 					Ingests documents in bulk, using the bulk API `create` action.
 
 					Elasticsearch Data Streams only support the `create` action.
+
+					If the mode is set to `data_stream` and a `timestamp` field is present in a message,
+					Vector renames this field to the expected `@timestamp` to comply with the Elastic Common Schema.
 					"""
 			}
 		}