Docs / Elasticsearch

Connect Elasticsearch

Search and analytics engine

Elasticsearch is a distributed search and analytics engine. climpt queries indices through the REST API using a role scoped to the index pattern you choose.

Credentials

Host
Hostname or IP, for example elasticsearch.example.com.
Port
9200 unless you have changed it.
Username
Optional, if security is enabled — and it should be.
Password
Optional, if security is enabled.
Index pattern
Which indices to expose, for example analytics-*. Wildcards are supported; prefer a specific prefix over a bare *.

Before you start

Security is on by default from 8.x onwards. Confirm it in elasticsearch.yml:

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.enabled: true

Also set network.host to a specific address rather than 0.0.0.0, and open port 9200 only to the addresses that need it.

Creating a read-only role and user

Through the REST API, or Kibana’s Stack Management if you prefer.

PUT _security/role/climpt_readonly_role
{
  "indices": [
    {
      "names": ["analytics-*"],
      "privileges": ["read", "view_index_metadata"]
    }
  ]
}

read covers search and get. view_index_metadata lets climpt read mappings and settings, which is how it understands the shape of your data. Neither permits indexing, updating or deleting.

PUT _security/user/climpt_readonly
{
  "password": "strong_password_here",
  "roles": ["climpt_readonly_role"],
  "full_name": "climpt read-only"
}

Verifying

curl -u climpt_readonly:strong_password_here \
  https://elasticsearch.example.com:9200/analytics-*/_search?size=1

Managed Elasticsearch

  • Elastic Cloud — take the endpoint URL or Cloud ID from the deployment page; TLS is on by default. Create users under Kibana → Stack Management → Security → Users.
  • AWS OpenSearch — use the domain endpoint from the console. Both IAM and internal user authentication are supported, and access policies can restrict by IP or IAM role.

The role and user API calls above are unchanged on both.

Worth knowing

  • API keys with restricted privileges are a good alternative to a username and password, and are easier to rotate.
  • Scope the index pattern as narrowly as you can — it is the main control over what climpt can see.