Ansible Control Server connector
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Preview
Preview
Stack
Planned
Planned
The Ansible Control Server connector calls the Ansible Automation Controller / AWX API to list job templates, launch jobs, and diagnose failures via stdout and job events. It authenticates with a long-lived API bearer token and can verify the server TLS certificate against a pasted PEM CA.
You can use this connector in Agent Builder and Workflows.
This connector can perform any operation the configured token is authorized for, including launching jobs that mutate real infrastructure. There are no additional restrictions in Kibana: access is governed entirely by the token's Controller / AWX permissions. Prefer a least-privilege automation user scoped to specific templates and organizations.
You can create connectors in Stack Management > Connectors.
Ansible Control Server connectors have the following configuration properties:
- API server URL
- The base URL of the Controller / AWX server, for example
https://controller.example.com. This host must be permitted by thexpack.actions.allowedHostssetting. - API base path
- API root path prepended to typed actions. Use
/api/v2for AWX, Tower, and AAP ≤2.4. Use/api/controller/v2for AAP 2.5+ platform gateway installs. Default:/api/v2.
API token
- Token
- A long-lived personal access token (PAT) or OAuth2 application token. The connector sends it in the
Authorization: Bearer <token>header. Do not paste short-lived session cookies. - Server CA certificate (PEM)
- Optional PEM-encoded certificate authority used to verify the server certificate.
- Verification mode
- How to verify the server TLS certificate:
full(default),certificate, ornone(not recommended).
You can test connectors when you create or edit the connector in Kibana. The test requests the authenticated user (GET …/me/) to verify connectivity and authentication.
The connector has the following actions:
request- Make an authenticated request to any Controller / AWX API path. Prefer typed actions when they fit.
listJobTemplates/getJobTemplate/getJobTemplateLaunchOptions- Discover templates and launch-time prompts (
ask_*, survey defaults). launchJobTemplate- Launch a job (
extra_vars,limit,inventory, credentials, tags, and so on). Mutates infrastructure. listJobs/getJob/getJobStdout/listJobEvents/cancelJob- Monitor and diagnose job runs. Stdout is capped for agent-safe context size.
listInventories/listHosts/listProjects/getMe- Inventory, host, project, and identity reads. Credential secret fields are scrubbed.
- In Controller / AWX, create a dedicated automation user with execute permissions on the job templates the connector should use.
- Create a personal access token for that user (User → Tokens), or an OAuth2 application token.
- If the server uses a private CA, retrieve the CA certificate as PEM.
- Enter the API server URL, API base path, token, and optional CA when configuring the connector in Kibana.