elasticsearch/logstash — pull request #1184 by bodgit (2014-03-19 13:19:32+00:00)
Title: Elasticsearch bulk codec

This PR implements an Elasticsearch bulk codec, and should hopefully fix [LOGSTASH-1445](https://logstash.jira.com/browse/LOGSTASH-1445) and by association [LOGSTASH-928](https://logstash.jira.com/browse/LOGSTASH-928) & [LOGSTASH-1117](https://logstash.jira.com/browse/LOGSTASH-1117).

For decode, it only supports the ```index``` and ```create``` bulk operations and just picks out the document that follows those commands, so the ```_index```, ```_type```, and ```_id``` fields are lost. All other bulk operations are ignored.

Decode tested by ```nc(1)```'ing some bulk data to something like:

```
input {
tcp {
host => localhost
port => 12345
codec => elasticsearch
}
}

output {
stdout {
codec => rubydebug
}
}
```

For encode, the ```index```, ```index_type``` and ```document_id``` options are supported same as the other Elasticsearch-based outputs.

Encode tested with:

```
input {
tcp {
host => localhost
port => 12345
codec => line
type => test
}
}

filter {
uuid {
target => uuid
}
}

output {
rabbitmq {
host => localhost
exchange => elasticsearch
exchange_type => direct
key => elasticsearch
codec => elasticsearch {
document_id => "%{uuid}"
}
}
}
```

An Elasticsearch cluster with a river set up pointing to the same RabbitMQ successfully indexes the queue.

Once this is deemed usable I guess the ```elasticsearch_http``` and ```elasticsearch_river``` outputs are made obselete.