Timber supports the Elasticsearch
/_bulk endpoint protocol, allowing you to point existing Elasticsearch clients to Timber. This makes Timber a drop in replacement for Elasticsearch ingestion.
Configure your client's URL to be
Configure your client's headers to include the
Authorization: Bearer YOUR_API_KEY, replacing
Configure your client's buffer size to flush at 950kb or after 2 seconds (see limitations below).
Timber does not support the
update Elasticsearch bulk actions. Your log data in Timber is immutable.
_id fields for the
index actions are ignored. Timber handles the values of these attributes for you.
Timber does not accept request payloads larger than
1mb in size, including headers. Timber is a real-time platform, providing real-time insight, and is designed for streaming ingestion of data.