Summary

We define an output to ES but only test currently with ES6. We would like to advertise we can write logs to ES5 through ES7 so that user's who manage their own Elasticsearch can still use LogForwarding

Acceptance Criteria

• Log Forwarding test that verifies cluster logging is capable of writing to Elasticsearch 7
• Document the setup requirements to enable them to ingest logs provided by Log Forwarder (e.g. CL data model, aliases)
• Document the supported versions of ES

Notes

• Documentation is likely the same for writing to any ES and we may already include:
• Predefined "write" alias for each source type (e.g. app-write, infra-write)
• A note that these indices will be created if the alias does not exists when we first attempt to write to the instance