Add one-shot Elasticsearch bulk export with ECS field mapping

[nikfot]

Summary

• Adds export-es subcommand for one-shot bulk indexing of parsed vmstat data into Elasticsearch
• Maps vmstat fields to ECS-compatible names for correlation with other observability data
• Supports Elastic Cloud (--cloud-id) and self-managed clusters (--es-url)
• --dry-run mode prints bulk NDJSON to stdout without needing elasticsearch-py
• elasticsearch-py is a lazy optional dependency

ECS Field Mapping

vmstat	ECS field	Conversion
time	@timestamp	ISO 8601
us/sy/id/wa/st	system.cpu.*.pct	0-100 -> 0.0-1.0
free/swpd/inact/active	system.memory.*.bytes	KB -> bytes
bi/bo	system.diskio.*.bytes	KB -> bytes

Usage

# Dry run (no ES needed)
vmstat-visualizer export-es vmstat.log --dry-run --index vmstat-investigation

# Send to Elastic Cloud
vmstat-visualizer export-es vmstat.log --cloud-id CLOUD_ID --es-api-key KEY --index vmstat-2025.08

# Send to self-managed
vmstat-visualizer export-es vmstat.log --es-url https://localhost:9200 --es-api-key KEY

Design Decision

This is a one-shot post-hoc exporter, not a live shipper. See plan discussion for why a live vmstat wrapper was rejected (duplicates Metricbeat, contradicts tool identity, high maintenance burden).

Test plan

• Verified ECS doc structure with dry-run
• KB-to-bytes and pct-to-decimal conversions verified
• Clear error message when elasticsearch-py missing
• --dry-run works without any ES dependency