Elasticsearch

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	No	—	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	Cluster connection controls.	—	no extra properties
optional.connection.request_timeout_seconds	number	No	Network timeout in seconds for cluster API calls	30	min 1, max 300
optional.connection.verify_ssl	boolean	No	TLS certificate verification toggle	true	—
optional.scope	object	No	Index selection scope.	—	no extra properties
optional.scope.exclude_indices	array	No	Index denylist	—	—
optional.scope.exclude_indices[]	string	No	—	—	—
optional.scope.include_indices	array	No	Optional index allowlist	—	—
optional.scope.include_indices[]	string	No	—	—	—
optional.scope.include_system_indices	boolean	No	Include system indices (names starting with .)	false	—
optional.scope.index_limit	integer	No	Optional cap on number of index assets	—	min 1

Extracted Metadata

Index

Field	Type	Required	Description
index_name	string	Yes	Index name
health	string	No	Index health (green/yellow/red)
doc_count	integer	Yes	Number of documents in the index
store_size_bytes	integer	No	Index store size in bytes
primary_shards	integer	No	Number of primary shards
replica_shards	integer	No	Number of replica shards

Examples

Local dev cluster scan

Discover indices and sample documents on a local, unauthenticated Elasticsearch cluster

Config Payload

{
  "type": "ELASTICSEARCH",
  "required": {
    "auth_mode": "NONE",
    "url": "http://localhost:9200"
  },
  "optional": {
    "scope": {
      "include_system_indices": false
    }
  },
  "sampling": {
    "strategy": "LATEST",
    "rows_per_page": 50
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekday_business",
  "cron": "15 6 * * 1-5",
  "timezone": "UTC"
}

Basic auth secrets detection

Sample documents from selected indices using basic auth and run secrets detection

Config Payload

{
  "type": "ELASTICSEARCH",
  "required": {
    "auth_mode": "BASIC",
    "url": "https://es.internal.example.com:9200"
  },
  "masked": {
    "username": "elastic",
    "password": "your-password"
  },
  "optional": {
    "connection": {
      "verify_ssl": true
    },
    "scope": {
      "include_indices": [
        "orders",
        "customers"
      ]
    }
  },
  "sampling": {
    "strategy": "RANDOM",
    "rows_per_page": 100
  },
  "detectors": [
    {
      "type": "SECRETS",
      "enabled": true
    },
    {
      "type": "PII",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "weekday_business",
  "cron": "40 8 * * 1-5",
  "timezone": "UTC"
}

Elastic Cloud with API key

Connect to an Elastic Cloud deployment using an API key (bearer token) instead of a username/password

Config Payload

{
  "type": "ELASTICSEARCH",
  "required": {
    "auth_mode": "API_KEY",
    "url": "https://my-deployment.es.us-east-1.aws.found.io:9243"
  },
  "masked": {
    "api_key": "your-base64-encoded-api-key"
  },
  "optional": {
    "scope": {
      "exclude_indices": [
        ".kibana*"
      ]
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC",
    "rows_per_page": 100
  }
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "10 2 * * *",
  "timezone": "UTC"
}