Discuss about Elasticsearch output

[smalenfant]

This would be my first question, data duplication in the Elastic output.

Here's my output configuration:

exporters:
  elasticsearch:
    endpoint: https://lab-cdn.es:443
    auth:
      authenticator: basicauth/elastic
    include_source_on_error: true

metric pipeline:

      receivers:
        - otlpjsonfile
      exporters:
         - elasticsearch

In the elastic output, all attributes and metrics are duplicated. Who's duplicating all this?

{
  "@timestamp": "2025-06-05T21:45:51.161Z",
  "_metric_names_hash": "6150d3ae",
  "attributes.ifIndex": "8230",
  "attributes.ifType": "docsOfdmDownstream",
  "attributes.instance": "neptunium0",
  "attributes.profile": "3",
  "data_stream.dataset": "docsis.otel",
  "data_stream.namespace": "default",
  "data_stream.type": "metrics",
  "event.dataset": "docsis.otel",
  "ifIndex": "8230",
  "ifType": "docsOfdmDownstream",
  "instance": "neptunium0",
  "metrics.ossi_DocsIf31CmtsDsOfdmProfileStatsOutOctets": 62508200,
  "ossi_DocsIf31CmtsDsOfdmProfileStatsOutOctets": 62508200,
  "profile": "3",
  "resource.attributes.service.name": "kepler",
  "scope.name": "test",
  "scope.version": "0.2",
  "service.name": "kepler",
  "table": "DocsIfCmtsCmStatusTable"
}

[smalenfant]

Pinging Elastic Exporter contributors: @JaredTan95, @carsonip, @lahsivjar

[carsonip]

Hi @smalenfant , thanks for the question. May I ask where did you obtain this JSON?

{
  "@timestamp": "2025-06-05T21:45:51.161Z",
  "_metric_names_hash": "6150d3ae",
  "attributes.ifIndex": "8230",
  "attributes.ifType": "docsOfdmDownstream",
  "attributes.instance": "neptunium0",
  "attributes.profile": "3",
  "data_stream.dataset": "docsis.otel",
  "data_stream.namespace": "default",
  "data_stream.type": "metrics",
  "event.dataset": "docsis.otel",
  "ifIndex": "8230",
  "ifType": "docsOfdmDownstream",
  "instance": "neptunium0",
  "metrics.ossi_DocsIf31CmtsDsOfdmProfileStatsOutOctets": 62508200,
  "ossi_DocsIf31CmtsDsOfdmProfileStatsOutOctets": 62508200,
  "profile": "3",
  "resource.attributes.service.name": "kepler",
  "scope.name": "test",
  "scope.version": "0.2",
  "service.name": "kepler",
  "table": "DocsIfCmtsCmStatusTable"
}

I suspect that there is no "duplication". ES 8.16+ and es exporter otel mode works together using passthrough field type to make it easier for users to query. Only 1 copy of the field is stored, but it "appears" to be both under attributes prefix and at root level.

In Kibana dev tools, if you try

GET metrics-*.otel-*/_search

You'll be able to see what's actually sent to Elasticsearch.

[smalenfant]

Thanks, that passthrough explains a lot. I wasn't aware of this.

I had a few other questions.

Is there a way to get debug output of documents sent to Elastic?
How can I merge my metrics in the same document? I tried the following:

processors:
  groupbyattrs:
    keys:
      - table
      - instance
      - IfIndex

I also added

  elasticsearch:
    batcher:
      enabled: true

And:

processors:
  batch:

I'm not sure how that fits in for the timestamp either.

[carsonip]

Is there a way to get debug output of documents sent to Elastic?

For debug output, please refer to telemetry settings: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/elasticsearchexporter#telemetry-settings

How can I merge my metrics in the same document?

They will not be merged unless data points have the same dimensions, i.e. all resource attributes, scope attributes, data point attributes, timestamp, etc.

The data points will also need to be in the same request sent to elasticsearch exporter.

[smalenfant]

@carsonip Sorry, I didn't answer the question where I got that JSON. It's the document output in Elasticsearch.

[smalenfant]

Ok, so I was able to merge all my documents together using those processors :

  groupbyattrs:
    keys:
      - table
      - mac
  interval:
    interval: 15s

      processors:
        - filter/include
        - attributes/add
        - attributes/delete
        - resource/delete
        - groupbyattrs
        - interval
        - batch

I also believe that batcher: enabled: true was needed on the elastic plugin.

It wrote the following into Elastic which is exactly what I needed:

"metrics": {
      "ossi_DocsIfCmtsCmStatusExtUnerroreds": 5541741,
      "ossi_DocsIfCmtsCmStatusTimingOffset": 1596,
      "ossi_DocsIfCmtsCmStatusExtCorrecteds": 58462,
      "ossi_DocsIfCmtsCmStatusSignalNoise": 38,
      "ossi_DocsIfCmtsCmStatusValue": 6,
      "ossi_DocsIfCmtsCmStatusMicroreflections": 0,
      "ossi_DocsIfCmtsCmStatusExtUncorrectables": 0,
      "ossi_DocsIfCmtsCmStatusRxPower": 0
    },

Now I need to rename some fields.