External Elasticsearch connector

The External Elasticsearch connector calls the Elasticsearch REST API on a remote cluster so an agent can search and explore data, inspect index mappings and aliases, run ES|QL analytics queries, and retrieve cluster information. Use this connector when you need to query data on a separate Elasticsearch cluster — for example, a different Elastic Cloud deployment, a serverless project, an on-prem cluster behind a firewall, or any other cluster that is not directly accessible via cross-cluster search (CCS). The connector can be created from any Kibana deployment (including serverless) and can connect to any Elasticsearch cluster endpoint, whether Elastic Cloud, serverless, or self-managed.

You can create connectors in Stack Management > Connectors.

Elasticsearch connectors have the following configuration properties:

Elasticsearch URL

The cluster endpoint URL. For Elastic Cloud, use the Elasticsearch endpoint shown in your deployment in the Elastic Cloud console (for example, https://my-deployment.es.us-east-1.aws.elastic.cloud). For self-managed clusters, use the full URL including port, for example https://elasticsearch.example.com:9200.

Elasticsearch API key (recommended)

API Key

The encoded API key value, which is the base64-encoded id:api_key string from the create API key response (POST /_security/api_key). Grant the key at minimum: read privilege on the indices you search.

Username and password

Username

An Elasticsearch user with at minimum read privilege on the indices you search.

Password

The password for that user.

You can test connectors when you create or edit the connector in Kibana. The test calls GET / to verify connectivity and return cluster name and version information.

The Elasticsearch connector has the following actions:

search

Search documents in one or more indices using the Elasticsearch Query DSL. Pass the query in the query parameter, with exactly one top-level query type such as match or bool; combine clauses with bool. Supports aggregations (aggs), sorting, field filtering (_source), and pagination (size, from). Use listIndices first if you do not know the index name, and getMapping to understand the available fields.

esql

Run an ES|QL query — a pipe-based analytics language optimized for time-series exploration and aggregations. Returns a columnar result set with column names and row values. Requires Elasticsearch 8.11 or later.

listIndices

List indices and data streams with their health, status, document count, and storage size. Optionally filter by name pattern (for example, logs-*). Use this to discover available indices before calling search, getMapping, or esql.

getMapping

Retrieve the field mapping for an index: field names, types, and configured analyzers or sub-fields. Use this to understand which fields are available before constructing a query.

request

Make an arbitrary GET request to any Elasticsearch REST API path. Use this as an escape hatch when no typed action covers the endpoint you need — for example, GET /_cluster/health, GET /_alias, or GET /_nodes. The base cluster URL is prepended automatically.

getClusterInfo

Get basic information about the cluster: name, version, and build. To check shard/node counts and cluster status, use the request action with path /_cluster/health.

Elasticsearch API key

1. Log in to Kibana and go to Stack Management > API Keys.
2. Click Create API key.
3. Give the key a name and, under Control security privileges, grant at minimum:
   • read indices privilege on the index patterns you intend to search.
4. Click Create API key, then copy the Encoded value.
5. Enter the Elasticsearch endpoint URL and the encoded key when configuring the connector in Kibana.

Alternatively, create the key via the API:

POST /_security/api_key
{
  "name": "kibana-elasticsearch-connector",
  "role_descriptors": {
    "connector-role": {
      "cluster": [],
      "indices": [
        {
          "names": ["logs-*", "metrics-*"],
          "privileges": ["read"]
        }
      ]
    }
  }
}

Use the encoded field from the response as the API Key value.

Username and password (self-managed clusters)

1. Create a dedicated Elasticsearch user (for example, using the Create or update users API).
2. Assign a role granting at minimum read on the indices you search.
3. Enter the cluster URL, username, and password when configuring the connector in Kibana.