Add support for idle_connection_timeout to elasticsearch output (#36843)

* Add support for idle_connection_timeout to elasticsearch output

CHANGELOG.next.asciidoc

@@ -173,6 +173,7 @@ is collected by it.
 - allow `queue` configuration settings to be set under the output. {issue}35615[35615] {pull}36788[36788]
 - Beats will now connect to older Elasticsearch instances by default {pull}36884[36884]
 - Raise up logging level to warning when attempting to configure beats with unknown fields from autodiscovered events/environments
+- elasticsearch output now supports `idle_connection_timeout`. {issue}35616[35615] {pull}36843[36843]
 
 *Auditbeat*
 

auditbeat/auditbeat.reference.yml

@@ -522,6 +522,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

filebeat/filebeat.reference.yml

@@ -1618,6 +1618,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

heartbeat/heartbeat.reference.yml

@@ -614,6 +614,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

libbeat/_meta/config/output-elasticsearch.reference.yml.tmpl

@@ -81,6 +81,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

libbeat/outputs/elasticsearch/client.go

@@ -102,6 +102,7 @@ func NewClient(
 		CompressionLevel: s.CompressionLevel,
 		EscapeHTML:       s.EscapeHTML,
 		Transport:        s.Transport,
+		IdleConnTimeout:  s.IdleConnTimeout,
 	})
 	if err != nil {
 		return nil, err

libbeat/outputs/elasticsearch/docs/elasticsearch.asciidoc

@@ -689,6 +689,12 @@ default is `1s`.
 The maximum number of seconds to wait before attempting to connect to
 Elasticsearch after a network error. The default is `60s`.
 
+===== `idle_connection_timeout`
+
+The maximum amount of time an idle connection will remain idle before closing itself.
+Zero means no limit. The format is a Go language duration (example 60s is 60 seconds).
+The default is 0.
+
 ===== `timeout`
 
 The http request timeout in seconds for the Elasticsearch request. The default is 90.

libbeat/outputs/elasticsearch/elasticsearch.go

@@ -41,7 +41,9 @@ func makeES(
 ) (outputs.Group, error) {
 	log := logp.NewLogger(logSelector)
 	if !cfg.HasField("bulk_max_size") {
-		_ = cfg.SetInt("bulk_max_size", -1, defaultBulkSize)
+		if err := cfg.SetInt("bulk_max_size", -1, defaultBulkSize); err != nil {
+			return outputs.Fail(err)
+		}
 	}
 
 	index, pipeline, err := buildSelectors(im, beat, cfg)
@@ -105,6 +107,7 @@ func makeES(
 				Observer:         observer,
 				EscapeHTML:       esConfig.EscapeHTML,
 				Transport:        esConfig.Transport,
+				IdleConnTimeout:  esConfig.Transport.IdleConnTimeout,
 			},
 			Index:              index,
 			Pipeline:           pipeline,

metricbeat/metricbeat.reference.yml

@@ -1357,6 +1357,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

packetbeat/packetbeat.reference.yml

@@ -988,6 +988,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

winlogbeat/winlogbeat.reference.yml

@@ -404,6 +404,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/auditbeat/auditbeat.reference.yml

@@ -578,6 +578,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/filebeat/filebeat.reference.yml

@@ -3988,6 +3988,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/functionbeat/functionbeat.reference.yml

@@ -646,6 +646,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/heartbeat/heartbeat.reference.yml

@@ -614,6 +614,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/metricbeat/metricbeat.reference.yml

@@ -1918,6 +1918,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/osquerybeat/osquerybeat.reference.yml

@@ -365,6 +365,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/packetbeat/packetbeat.reference.yml

@@ -988,6 +988,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90
 

x-pack/winlogbeat/winlogbeat.reference.yml

@@ -406,6 +406,11 @@ output.elasticsearch:
   # Elasticsearch after a network error. The default is 60s.
   #backoff.max: 60s
 
+  # The maximum amount of time an idle connection will remain idle
+  # before closing itself.  Zero means use the default of 60s. The
+  # format is a Go language duration (example 60s is 60 seconds).
+  # idle_connection_timeout: 60s
+
   # Configure HTTP request timeout before failing a request to Elasticsearch.
   #timeout: 90