LinkMesh

Search docs, blog and changelog

ENDE

Snippets · Destinations

Send logs and traces to Elasticsearch

The elasticsearch exporter writes OpenTelemetry logs and traces straight into Elasticsearch data streams. mapping.mode: otel keeps the OpenTelemetry field names (the alternative, ecs, rewrites them to Elastic Common Schema); the API key comes from the environment.

Signals
LogsTraces
Source
OTLP
Components
otlpbatchmemory_limiterelasticsearch
Destination
Elasticsearch

OpenTelemetry Collector

OpenTelemetry Collector YAML
receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  batch:
    timeout: 5s

exporters:
  elasticsearch:
    endpoints: [https://elasticsearch.example.internal:9200]
    api_key: ${env:ELASTICSEARCH_API_KEY}
    mapping:
      mode: otel
    logs_index: logs-otel-default
    traces_index: traces-otel-default
    sending_queue:
      enabled: true
      queue_size: 5000
    retry_on_failure:
      enabled: true
      initial_interval: 5s
      max_interval: 30s
      max_elapsed_time: 300s

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [memory_limiter, batch]
      exporters: [elasticsearch]
    traces:
      receivers: [otlp]
      processors: [memory_limiter, batch]
      exporters: [elasticsearch]

LinkMesh

LinkMesh has no built-in template for this job. Add it as a custom destination in raw mode, with elasticsearch as the component type and this body - the same lines as under elasticsearch in the collector config:

Custom destination body (elasticsearch)
endpoints: [https://elasticsearch.example.internal:9200]
api_key: ${env:ELASTICSEARCH_API_KEY}
mapping:
  mode: otel
logs_index: logs-otel-default
traces_index: traces-otel-default
sending_queue:
  enabled: true
  queue_size: 5000
retry_on_failure:
  enabled: true
  initial_interval: 5s
  max_interval: 30s
  max_elapsed_time: 300s

How custom components are validated and rolled out: create a custom destination.

Download config.yamlValidated with otelcol-contrib v0.161.0 on 2026-10-26

Complete config files, each checked with the collector's own validate command (otelcol-contrib v0.161.0).

The gotcha

This exporter's settings have changed across recent collector versions. In our test the same config that otelcol-contrib 0.161.0 validates was rejected by 0.153.0 with "invalid keys: retry_on_failure", and 0.153.0 also rejected the older index key. Validate against the exact collector version you run before you roll this out.

Used in these pipelines

Manage this across a fleet

LinkMesh manages collector configuration across a fleet from one self-hosted control plane, so a change like this is made once rather than host by host. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).

Doing this in LinkMesh: Destinations

Install LinkMesh →See all snippets

Related snippets