Elasticsearch _bulk

curl -X POST http://localhost:5080/api/v1/_bulk \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/x-ndjson' \
  --data-binary $'{"index":{"_index":"app"}}\n{"level":"info","msg":"hello"}\n'

{ "took": 0, "errors": false, "items": [ { "index": { "status": 201 } } ] }

curl -X POST http://localhost:5080/api/v1/_bulk \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/x-ndjson' \
  --data-binary $'{"index":{"_index":"app"}}\n{"level":"info","msg":"hello"}\n'

{ "took": 0, "errors": false, "items": [ { "index": { "status": 201 } } ] }

POST /api/v1/_bulk

Elasticsearch _bulk-compatible NDJSON intake for Filebeat, Logstash, and the Vector elasticsearch sink. The call requires streams.write. A body with Content-Encoding: gzip is accepted.

Action	Handling
`index`, `create`, `update`	The source document is stored as a log event.
`delete`	Acknowledged and ignored. Telemetry is never deleted through this endpoint.

The _index of an action selects the target log stream. Without it, the stream-name header applies, and then default.

curl -X POST http://localhost:5080/api/v1/_bulk \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/x-ndjson' \
  --data-binary $'{"index":{"_index":"app"}}\n{"level":"info","msg":"hello"}\n'

{ "took": 0, "errors": false, "items": [ { "index": { "status": 201 } } ] }

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration