Create output

Base URL: https://{kibana_url}

POST /api/fleet/outputs

Create a new Fleet output.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Header parameters

Request body

One of:

type: elasticsearch

type enum required: Values: elasticsearch
allow_edit string[] · max items: 1000
ca_sha256 string nullable
ca_trusted_fingerprint string nullable
config_yaml string nullable
hosts string[] · format: uri · min items: 1 · max items: 100 required
id string
is_default boolean · default: false
is_default_monitoring boolean · default: false
is_internal boolean
is_preconfigured boolean
name string required
otel_disable_beatsauth boolean nullable
otel_exporter_config_yaml string nullable
preset enum: Values: balanced custom throughput scale latency
proxy_id string nullable
secrets object
shipper object
ssl object
write_to_logs_streams boolean nullable

type: remote_elasticsearch

type enum required: Values: remote_elasticsearch
allow_edit string[] · max items: 1000
ca_sha256 string nullable
ca_trusted_fingerprint string nullable
config_yaml string nullable
hosts string[] · format: uri · min items: 1 · max items: 100 required
id string
is_default boolean · default: false
is_default_monitoring boolean · default: false
is_internal boolean
is_preconfigured boolean
kibana_api_key string nullable
kibana_url string nullable
name string required
otel_disable_beatsauth boolean nullable
otel_exporter_config_yaml string nullable
preset enum: Values: balanced custom throughput scale latency
proxy_id string nullable
secrets object
service_token string nullable
shipper object: Same fields as shipper in new_output_elasticsearch
ssl object
sync_integrations boolean
sync_uninstalled_integrations boolean
write_to_logs_streams boolean nullable

type: logstash

type enum required: Values: logstash
allow_edit string[] · max items: 1000
ca_sha256 string nullable
ca_trusted_fingerprint string nullable
config_yaml string nullable
hosts string[] · min items: 1 · max items: 100 required
id string
is_default boolean · default: false
is_default_monitoring boolean · default: false
is_internal boolean
is_preconfigured boolean
name string required
otel_disable_beatsauth boolean nullable
otel_exporter_config_yaml string nullable
proxy_id string nullable
secrets object
shipper object: Same fields as shipper in new_output_elasticsearch
ssl object

type: kafka

type enum required: Values: kafka
allow_edit string[] · max items: 1000
auth_type enum required: Values: none user_pass ssl kerberos
broker_timeout number
ca_sha256 string nullable
ca_trusted_fingerprint string nullable
client_id string
compression enum: Values: gzip snappy lz4 none
compression_level number nullable
config_yaml string nullable
connection_type enum: Values: plaintext encryption
hash object
headers object[] · max items: 100
hosts string[] · min items: 1 · max items: 100 required
id string
is_default boolean · default: false
is_default_monitoring boolean · default: false
is_internal boolean
is_preconfigured boolean
key string
name string required
otel_disable_beatsauth boolean nullable
otel_exporter_config_yaml string nullable
partition enum: Values: random round_robin hash
password string nullable
proxy_id string nullable deprecated: Kafka outputs do not support proxy configuration. This field is accepted for backwards compatibility but is ignored — it is cleared to null on save and has no effect on the compiled agent policy.
random object
required_acks enum: Values: 1 0 -1
round_robin object
sasl object nullable
secrets object
shipper object: Same fields as shipper in new_output_elasticsearch
ssl object
timeout number
topic string
username string nullable
version string

type: otlp

type enum required: Values: otlp
allow_edit string[] · max items: 1000
id string
is_default boolean · default: false
is_default_monitoring boolean · default: false
is_internal boolean
is_preconfigured boolean
name string required
otlp_exporter union oneOf required: One of: (determined by protocol)
secrets object

Responses

Successful response

application/json

item union oneOf required: One of: (determined by type)

Bad Request

application/json