Back to plugin list


This plugin is in preview.

The Elasticsearch plugin syncs data from any CloudQuery source plugin(s) to an Elasticsearch cluster


Latest version




Date Published

Feb 20, 2024




Elasticsearch Destination Plugin

The Elasticsearch plugin syncs data from any CloudQuery source plugin(s) to an Elasticsearch cluster.

Example config

The following config will sync data to an Elasticsearch cluster running on localhost:9200:
kind: destination
  name: elasticsearch
  path: cloudquery/elasticsearch
  registry: cloudquery
  version: "v3.2.1"
  write_mode: "overwrite-delete-stale"
    # Optional parameters
    # addresses: ["http://localhost:9200"]
    # username: ""
    # password: ""
    # cloud_id: ""
    # api_key: ""
    # service_token: ""
    # certificate_fingerprint: ""
    # ca_cert: ""
    # concurrency: 5 # default: number of CPUs
    # batch_size: 1000
    # batch_size_bytes: 5242880 # 5 MiB
The Elasticsearch destination utilizes batching, and supports batch_size and batch_size_bytes.
It supports append, overwrite and overwrite-delete-stale write modes. The default write mode is overwrite-delete-stale.

Elasticsearch Spec

This is the spec used by the Elasticsearch destination plugin.
  • addresses ([]string) (optional) (default: ["http://localhost:9200"])
    A list of Elasticsearch nodes to use.
  • username (string) (optional)
    Username for HTTP Basic Authentication.
  • password (string) (optional)
    Password for HTTP Basic Authentication.
  • cloud_id (string) (optional)
    Endpoint for the Elastic Service (
  • api_key (string) (optional)
    Base64-encoded token for authorization; if set, overrides username/password and service token.
  • service_token (string) (optional)
    Service token for authorization; if set, overrides username/password.
  • certificate_fingerprint (string) (optional)
    SHA256 hex fingerprint given by Elasticsearch on first launch.
  • ca_cert (string) (optional)
    PEM-encoded certificate authorities. When set, an empty certificate pool will be created, and the certificates will be appended to it. See file variable substitution for how to read this value from a file.
  • concurrency (string) (optional) (default: number of CPUs)
    Number of concurrent worker goroutines to use for indexing.
  • batch_size (integer) (optional) (default: 1000)
    Maximum number of items that may be grouped together to be written in a single write.
  • batch_size_bytes (integer) (optional) (default: 5242880 (5 MiB))
    Maximum size of items that may be grouped together to be written in a single write.

Index Template Creation

The Elasticsearch destination will create an index template for every table during the migration step. It is recommended that you use the generated index templates, as it will automatically create indexes with the correct mappings for the table. However, to skip index template creation (or use your own), you may use the --no-migrate option when running cloudquery sync.

Index Naming

Index names will be formatted according to the selected write mode:
  • append: indexes will be named using the format <table_name>-<YYYY-MM-DD>. In other words, a new index will be created every day the table is synced. Entries will never be overwritten.
  • overwrite: indexes will be named using the format <table_name>. Objects with duplicate primary keys will be overwritten.
  • overwrite-delete-stale: indexes will be named using the format <table_name>. Objects with duplicate primary keys will be overwritten, and any objects that are not present in the current sync will be deleted.
Index templates will also be created such that they match the index names generated by the selected write mode.

Querying From Kibana

To query data from Kibana, you will need to create data views (previously also known as "index patterns"). To query a specific table, the data view's index pattern should be in the format <table_name>-*. For example, if you have a table named aws_ec2_instances, you should create a data view with index pattern named aws_ec2_instances-*. One useful feature of Elasticsearch and Kibana, however, is the ability to query across all data. To do this for the aws source plugin, for example, you may use an index pattern named aws_*. This will then allow queries across all tables synced by the aws source plugin.

Underlying library

We use the official go-elasticsearch package. It is tested against Elasticsearch 8.6.0. Please open an issue if you encounter any problems with this (or another) version.


Elasticsearch Types

The Elasticsearch destination (v2.0.0 and later) supports most Apache Arrow types. The following table shows the supported types and how they are mapped to Elasticsearch field data types.
Arrow Column TypeSupported?Elasticsearch Type
Binary✅ Yesbinary
Boolean✅ Yesboolean
Date32✅ Yesdate with format yyyy-MM-dd
Date64✅ Yesdate with format yyyy-MM-dd
Decimal✅ Yestext
Dense Union✅ Yestext
Dictionary✅ Yestext
Duration[ms]✅ Yestext
Duration[ns]✅ Yestext
Duration[s]✅ Yestext
Duration[us]✅ Yestext
Fixed Size List✅ YesUses type from list elements
Float16✅ Yeshalf_float
Float32✅ Yesfloat
Float64✅ Yesdouble
Inet✅ Yestext
Int8✅ Yesbyte
Int16✅ Yesshort
Int32✅ Yesinteger
Int64✅ Yeslong
Interval[DayTime]✅ Yesobject
Interval[MonthDayNano]✅ Yesobject
Interval[Month]✅ Yesobject
JSON✅ Yestext
Large Binary✅ Yesbyte
Large List✅ YesUses type from list elements
Large String✅ Yestext
List✅ YesUses type from list elements
MAC✅ Yestext
Map✅ Yesobject with key and value fields
String✅ Yestext
Struct✅ Yesobject
Time32[s]✅ Yesdate with format HH:mm:ss
Time32[ms]✅ Yesdate with format HH:mm:ss.SSS
Time64[us]✅ Yestext
Time64[ns]✅ Yestext
Timestamp[s]✅ Yesdate with format 2006-01-02T15:04:05Z
Timestamp[ms]✅ Yesdate with format 2006-01-02T15:04:05.999Z
Timestamp[us]✅ Yesdate with format 2006-01-02T15:04:05.999999Z"
Timestamp[ns]✅ Yesdate_nanos with format 2006-01-02T15:04:05.99999999Z
UUID✅ Yestext
Uint8✅ Yesunsigned_long
Uint16✅ Yesunsigned_long
Uint32✅ Yesunsigned_long
Uint64✅ Yesunsigned_long
Union✅ Yestext

Subscribe to product updates

Be the first to know about new features.