Global Disaster Alert and Coordination System (GDACS) Integration for Elastic
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Observability
Preview
Preview
Serverless Security
Preview
Preview
Stack
Preview
9.3+
Preview since 9.3
| Version | 0.2.0 Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. (View all) |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Community |
| Ingestion method(s) | API |
| Minimum Kibana version(s) | 9.3.1 |
To use pre-release integrations, go to the Integrations page in Kibana, scroll down, and toggle on the Display beta integrations option.
The Global Disaster Alert and Coordination System (GDACS) integration collects natural disaster alert events — earthquakes, tropical cyclones, floods, volcanoes, droughts, and wildfires — from the GDACS public API and indexes them into Elasticsearch with full ECS mapping, severity scoring, and geographic enrichment including affected-area polygons.
GDACS is a cooperation framework between the United Nations and the European Commission that provides near real-time alerts about natural disasters around the world, combining multiple hazard-monitoring sources.
This integration uses the GDACS public REST API. No authentication is required. The API is available at https://www.gdacs.org/gdacsapi/api.
The integration uses the CEL input to periodically poll the GDACS Search API for recent events. For each event returned, it fetches the detailed geometry polygon from the GDACS Polygons API (when available) and enriches the event with the affected area shape. Events are then processed through an ingest pipeline that normalizes fields to ECS and custom gdacs.* fields.
Key processing steps:
- Extracts centroid
geo_pointand affected-areageo_shapefrom GeoJSON geometry - Maps GDACS alert levels (Red/Orange/Green) to numeric
event.severityandevent.risk_score - Flattens affected country arrays into searchable keyword fields
- Deduplicates events using a fingerprint of
{event_id}-{episode_id} - Supports pagination across large result sets
The GDACS integration collects alert events of the following disaster types:
- EQ — Earthquakes
- TC — Tropical Cyclones
- FL — Floods
- VO — Volcanoes
- DR — Droughts
- WF — Wildfires
Each event includes alert level, severity data, geographic coordinates, affected-area polygons, affected countries, and links to GDACS report pages.
- Real-time situational awareness dashboards for natural disaster monitoring
- Geographic analysis of disaster impact zones using polygon overlays on maps
- Alerting on high-severity (Red/Orange) disaster events in specific regions or countries
- Correlation of disaster events with infrastructure or supply chain data
- Historical analysis of disaster patterns and trends
No special requirements. The GDACS API is publicly accessible and does not require authentication or API keys.
Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.
Elastic Agent is required to stream data from the GDACS API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
After deploying, verify data is flowing:
- In Kibana, go to Discover and select the
logs-gdacs.events-*data stream. - You should see documents with
event.kind: alertandevent.module: gdacs. - Check for
gdacs.event_type,gdacs.alert_level, andgeo.locationfields. - To verify polygon enrichment, check for
gdacs.affected_areaon events that have geometry data.
For help with Elastic ingest tools, check Common problems.
For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.
This integration is lightweight — GDACS typically has tens to hundreds of active events at any time, not thousands. The default 1-hour poll interval is sufficient for most use cases.
The events data stream provides natural disaster alert events from the GDACS Search API.
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword |
| event.modified | Timestamp when the GDACS event was last modified. | date |
| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. |
constant_keyword |
| gdacs.affected_area | WKT polygon, multipolygon or line representing the affected area of the disaster. | geo_shape |
| gdacs.affected_area.coordinates | Coordinates of the geo_shape geometry. | object |
| gdacs.affected_area.type | GeoJSON geometry type (e.g. "Polygon", "MultiPolygon"). | keyword |
| gdacs.affected_countries | Array of affected country objects with iso2, iso3, and countryname fields. | object |
| gdacs.affected_country_iso2 | List of affected country ISO 3166-1 alpha-2 codes. | keyword |
| gdacs.affected_country_iso3 | List of affected country ISO 3166-1 alpha-3 codes. | keyword |
| gdacs.affected_country_names | List of affected country names. | keyword |
| gdacs.alert_level | Overall alert level (Red, Orange, Green). | keyword |
| gdacs.alert_score | Numeric alert score. | double |
| gdacs.class | GeoJSON feature class: Point_Centroid (epicenter) or Poly_area (affected area polygon). | keyword |
| gdacs.country | Comma-separated country names from the event. | keyword |
| gdacs.description | Short text description of the event. | text |
| gdacs.episode_alert_level | Alert level for the current episode. | keyword |
| gdacs.episode_alert_score | Numeric alert score for the current episode. | double |
| gdacs.episode_id | GDACS episode identifier within an event. | keyword |
| gdacs.event_id | GDACS numeric event identifier. | keyword |
| gdacs.event_name | GDACS internal event name. | keyword |
| gdacs.event_type | GDACS event type code: EQ (Earthquake), TC (Tropical Cyclone), FL (Flood), VO (Volcano), DR (Drought), WF (Wildfire). | keyword |
| gdacs.event_type_name | Human-readable name for the GDACS event type. | keyword |
| gdacs.geo.country_iso_code | ISO 3166-1 alpha-2 country code of the primary affected country. | keyword |
| gdacs.geo.country_name | Name of the primary affected country. | keyword |
| gdacs.geo.location | Centroid coordinates of the event or affected area. | geo_point |
| gdacs.geo.location.coordinates | Coordinates of the geo_point as [lon, lat]. | object |
| gdacs.geo.location.type | GeoJSON type of the geo_point (always "Point"). | keyword |
| gdacs.geo.name | Human-readable name of the event location. | keyword |
| gdacs.geometry_role | Role of a tropical cyclone child geometry document: wind (wind band polygon), cone (forecast cone polygon), or track (track line). | keyword |
| gdacs.glide | GLobal IDEntifier (GLIDE) number for the disaster (e.g. DR-2023-000204-BRA). | keyword |
| gdacs.html_description | HTML-formatted description with alert level and date range. | text |
| gdacs.icon | URL to the GDACS map icon for this event. | keyword |
| gdacs.is_current | Whether the event is currently active. | boolean |
| gdacs.is_temporary | Whether the event is a temporary/preliminary alert. | boolean |
| gdacs.iso3 | Primary ISO 3166-1 alpha-3 country code. | keyword |
| gdacs.name | Human-readable event name (e.g. "Earthquake in Myanmar"). | keyword |
| gdacs.polygon_label | Label for the geometry type (Centroid, Affected Area). | keyword |
| gdacs.severity.text | Human-readable severity description. | keyword |
| gdacs.severity.unit | Unit of measure for the severity value. | keyword |
| gdacs.severity.value | Numeric severity value. Units vary by event type (magnitude for EQ, km2 for DR, km/h for TC, etc.). | double |
| gdacs.source | Data source (e.g. NEIC, GDO, JRC). | keyword |
| gdacs.source_id | Source-specific event identifier. | keyword |
| gdacs.url.details | URL to the GDACS event data API endpoint. | keyword |
| gdacs.url.geometry | URL to the GDACS geometry/polygon API endpoint. | keyword |
| gdacs.url.report | URL to the GDACS report page. | keyword |
| input.type | Type of input. | keyword |
Example
{
"@timestamp": "2025-04-07T01:52:47.000Z",
"agent": {
"ephemeral_id": "8179d174-f9a3-4bbb-aa9c-d1378919384d",
"id": "0859525e-958a-46db-81fa-c0bf21f3d9b9",
"name": "elastic-agent-94991",
"type": "filebeat",
"version": "9.4.1"
},
"data_stream": {
"dataset": "gdacs.events",
"namespace": "26841",
"type": "logs"
},
"ecs": {
"version": "9.4.0"
},
"elastic_agent": {
"id": "0859525e-958a-46db-81fa-c0bf21f3d9b9",
"snapshot": false,
"version": "9.4.1"
},
"event": {
"agent_id_status": "verified",
"dataset": "gdacs.events",
"end": "2025-04-06T22:00:23.000Z",
"id": "1476137-1632460",
"ingested": "2026-08-07T12:34:13Z",
"kind": "alert",
"modified": "2025-04-07T01:52:47.000Z",
"module": "gdacs",
"provider": "gdacs",
"reference": "https://www.gdacs.org/gdacsapi/api/events/geteventdata?eventtype=EQ&eventid=1476137",
"risk_score": 30,
"severity": 1,
"start": "2025-04-06T22:00:23.000Z",
"url": "https://www.gdacs.org/report.aspx?eventid=1476137&episodeid=1632460&eventtype=EQ"
},
"gdacs": {
"affected_area": {
"coordinates": [
[
[
163.364,
-10.54
],
[
163.362,
-10.477
],
[
163.35,
-10.383
],
[
163.329,
-10.291
],
[
163.297,
-10.202
],
[
163.257,
-10.117
],
[
163.207,
-10.036
],
[
163.15,
-9.961
],
[
163.084,
-9.892
],
[
163.012,
-9.83
],
[
162.933,
-9.776
],
[
162.85,
-9.73
],
[
162.761,
-9.693
],
[
162.669,
-9.666
],
[
162.575,
-9.648
],
[
162.48,
-9.639
],
[
162.384,
-9.641
],
[
162.289,
-9.652
],
[
162.195,
-9.674
],
[
162.105,
-9.704
],
[
162.018,
-9.744
],
[
161.935,
-9.793
],
[
161.859,
-9.85
],
[
161.789,
-9.914
],
[
161.726,
-9.985
],
[
161.671,
-10.062
],
[
161.624,
-10.145
],
[
161.587,
-10.232
],
[
161.559,
-10.322
],
[
161.54,
-10.414
],
[
161.531,
-10.508
],
[
161.531,
-10.54
],
[
161.532,
-10.571
],
[
161.54,
-10.665
],
[
161.559,
-10.758
],
[
161.587,
-10.848
],
[
161.624,
-10.935
],
[
161.671,
-11.017
],
[
161.726,
-11.094
],
[
161.789,
-11.166
],
[
161.859,
-11.23
],
[
161.935,
-11.287
],
[
162.018,
-11.335
],
[
162.105,
-11.375
],
[
162.195,
-11.406
],
[
162.289,
-11.427
],
[
162.384,
-11.438
],
[
162.48,
-11.44
],
[
162.575,
-11.432
],
[
162.669,
-11.414
],
[
162.761,
-11.386
],
[
162.85,
-11.349
],
[
162.933,
-11.304
],
[
163.012,
-11.25
],
[
163.084,
-11.188
],
[
163.15,
-11.119
],
[
163.207,
-11.043
],
[
163.257,
-10.963
],
[
163.297,
-10.877
],
[
163.329,
-10.788
],
[
163.35,
-10.696
],
[
163.362,
-10.603
],
[
163.364,
-10.54
]
]
],
"type": "Polygon"
},
"affected_countries": {
"countryname": "Solomon Is.",
"iso2": "SB",
"iso3": "SLB"
},
"affected_country_iso2": "SB",
"affected_country_iso3": "SLB",
"affected_country_names": "Solomon Is.",
"alert_level": "Green",
"alert_score": 1,
"class": "Poly_Circle",
"country": "Solomon Islands",
"description": "Earthquake in Solomon Islands",
"episode_alert_level": "Green",
"episode_alert_score": 0,
"episode_id": "1632460",
"event_id": "1476137",
"event_type": "EQ",
"event_type_name": "Earthquake",
"geo": {
"country_iso_code": "SB",
"country_name": "Solomon Is.",
"location": {
"coordinates": [
162.44779997505248,
-10.53970000706613
],
"type": "Point"
},
"name": "Earthquake in Solomon Islands"
},
"html_description": "Green M 4.6 Earthquake in Solomon Islands at: 06 Apr 2025 22:00:23.",
"icon": "https://www.gdacs.org/images/gdacs_icons/maps/Green/EQ.png",
"is_current": false,
"is_temporary": false,
"iso3": "SLB",
"name": "Earthquake in Solomon Islands",
"polygon_label": "100km",
"severity": {
"text": "Magnitude 4.6M, Depth:50.911km",
"unit": "M",
"value": 4.6
},
"source": "NEIC",
"source_id": "us6000q4fn",
"url": {
"details": "https://www.gdacs.org/gdacsapi/api/events/geteventdata?eventtype=EQ&eventid=1476137",
"geometry": "http://svc-gdacs:8080/gdacsapi/api/polygons/getgeometry?eventtype=EQ&eventid=1476137&episodeid=1632460",
"report": "https://www.gdacs.org/report.aspx?eventid=1476137&episodeid=1632460&eventtype=EQ"
}
},
"input": {
"type": "cel"
},
"message": "Earthquake in Solomon Islands",
"tags": [
"forwarded",
"gdacs-events"
]
}
These inputs can be used with this integration:
cel
For more details about the CEL input settings, check the Filebeat documentation.
Before configuring the CEL input, make sure you have:
- Network connectivity to the target API endpoint
- Valid authentication credentials (API keys, tokens, or certificates as required)
- Appropriate permissions to read from the target data source
To configure the CEL input, you must specify the request.url value pointing to the API endpoint. The interval parameter controls how frequently requests are made and is the primary way to balance data freshness with API rate limits and costs. Authentication is often configured through the request.headers section using the appropriate method for the service.
To access the API service, make sure you have the necessary API credentials and that the Filebeat instance can reach the endpoint URL. Some services may require IP whitelisting or VPN access.
To collect logs via API endpoint, configure the following parameters:
- API Endpoint URL
- API credentials (tokens, keys, or username/password)
- Request interval (how often to fetch data)
These APIs are used with this integration:
- GDACS Search API — Retrieves the list of disaster events matching filter criteria (event type, alert level, date range, country).
- GDACS Polygons API — Retrieves GeoJSON geometry features (centroid points and affected-area polygons) for a specific event episode.
This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 0.2.0 | Enhancement (View pull request) Handle geometry request network errors gracefully using is_error so that a timed-out polygon fetch no longer fails the entire evaluation. Add configurable request_timeout variable. |
9.3.1 |
| 0.1.0 | Enhancement (View pull request) Initial draft of the package |
9.3.1 |