Elasticsearch _bulk-compatible NDJSON intake for Filebeat, Logstash, and the Vector ES sink.
index, create, and update actions are received; delete actions are acknowledged but do not
delete telemetry. _index selects the target log stream, with stream-name (then default) as
the fallback. Gzip request bodies are accepted.
Send a JWT or ms_* API token as Authorization: Bearer .... The principal needs
streams.write. A successful response contains Elasticsearch-compatible errors and items[]
fields. Last modified on August 9, 2026
