Elasticsearch
Connect Elasticsearch so Ace can search your logs, metrics and traces during investigations.
Ace runs bounded, read-only searches against the indices your API key can read, looking for the errors and log lines around an incident.
| Category | Logs, metrics and traces via Elasticsearch |
| Ace reads | Log, metric and trace documents, index and field metadata |
| Ace can change | Nothing (read-only) |
| Opens incidents | No |
| Setup | Settings form |
What Ace reads
When you connect, Ace discovers your indices and data streams with their timestamp fields and most common fields, and samples values for fields such as service, namespace, environment, host and severity. It also checks whether your cluster supports search, ES|QL and field capabilities.
During an investigation, Ace runs searches over the incident window:
- Recent log lines at every level, and recent error logs, with message, severity, service, environment, namespace, host and trace ID.
- Error rate over time.
- The services with the most errors.
- An ES|QL error summary, when your cluster supports ES|QL.
- Recent metric and trace documents.
Ace uses Elasticsearch in investigations only after validation passes and discovery completes.
What Ace can change
Ace changes nothing in Elasticsearch, so the API key needs only read privileges.
What opens an incident
Elasticsearch doesn't open incidents, and Ace uses it only as evidence. To open incidents from alerts, connect an alert source such as Datadog or Prometheus.
Before you start
- The admin role in Ace.
- An Elasticsearch endpoint reachable over HTTPS.
- Permission in Kibana to create an API key.
Ace uses one Elasticsearch connection per workspace.
Private networks
Ace connects from its cloud to one HTTPS endpoint URL, with no agent for your network and no proxy or private-link option. Elastic Cloud endpoints work as they are.
A self-hosted cluster, or one in a VPC, needs an HTTPS endpoint reachable from outside your network, and Ace doesn't publish addresses to allowlist. If your cluster is reachable only inside a private network, contact our team before you connect.
Credentials and permissions
| Credential | Where to create it | Privileges | Why Ace needs it |
|---|---|---|---|
| API key | Kibana: Stack Management > API keys > Create API key | Index privileges read and view_index_metadata on the indices Ace should search | read runs searches. view_index_metadata discovers indices, data streams and fields |
When you create the key, turn on Control security privileges and grant only these privileges, on the indices Ace should search.
Set up
-
Find your Elasticsearch endpoint:
- In Elastic Cloud, open your deployment or project > Manage and choose Copy endpoint next to Elasticsearch.
- In Kibana, open Help > Connection details > Endpoints.
Use the Elasticsearch endpoint, not the Cloud ID.
-
Create the API key in Kibana, as described above.
-
In Ace, go to Settings > Data sources > Elasticsearch.
-
Enter the Endpoint URL, which must start with
https://, and the API key. -
Choose Connect Elasticsearch.
To change the endpoint or key, choose Update credentials, then Save and revalidate. Ace replaces the stored configuration, validates it again and refreshes discovery.
Confirm it's working
- The panel shows Validating integration… while Ace checks that the key authenticates and the cluster is healthy, and then Connected.
- After discovery, the panel lists the indexed data Ace found. If it shows No data indexed yet, wait for discovery to finish or check the key's index privileges.
- If a check fails, fix the cause and choose Re-validate.
Disconnect
In Ace, choose Disconnect in Settings > Data sources > Elasticsearch, then invalidate Ace's key in Kibana under Stack Management > API keys.
Next steps
- How Ace works: how evidence feeds an investigation.
- Security and data: what Ace stores.
- Integrations: connect an alert source.