Elasticsearch
Elasticsearch
Discover Elasticsearch indices and sample documents for detection.
- Category
- Databases
- Source type
- ELASTICSEARCH
- Produces
- index
Search clusters are copies. Whatever the source of truth held, the index holds a denormalised version of it — often with fields the original system would never have exposed, and usually with looser access control.
What you need to connect
The cluster URL, and one of: nothing (an unsecured cluster), basic auth (username and password), or an API key — the recommended option, because it can be scoped to read on specific indices and revoked on its own.
What Classifyre reads
Shared behaviour · Search engines
One asset per index, not per document. The asset's content is a sample of the documents in it, serialised so a detector sees the field values; the asset's metadata records the document count and the fields the index actually contains.
Only read APIs are used — cluster info, index listing, and search. A read-only key or user is enough, and is what we recommend.
Scope by index allow- and denylist, cap how many indices a run produces, and
choose whether system indices (names starting with .) are included.
Metadata on every asset
Asset kind · index
| Field | Type | Always present | What it is |
|---|---|---|---|
| index_name | string | Yes | Index name |
| health | string | No | Index health (green/yellow/red) |
| doc_count | integer | Yes | Number of documents in the index |
| store_size_bytes | integer | No | Index store size in bytes |
| primary_shards | integer | No | Number of primary shards |
| replica_shards | integer | No | Number of replica shards |
Lineage
Lineage
This source records no lineage. Nothing in the system it reads describes data moving from one place to another, so no FLOW edges are produced. Related items are still linked — see Lineage & Relationships for what those links mean and how they differ from lineage.
Worth knowing
- Elastic Cloud and self-hosted clusters connect identically; for a self-signed certificate, TLS verification can be relaxed — prefer trusting the CA where you can.
.securityand other system indices are excluded by default for a reason; include them deliberately.
Configuration
Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.
Required
Without these, the source will not save.
This section depends on which authentication method you pick — one of the following applies.
No Authentication
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "NONE" | Yes | — | — |
| url | string | Yes | Base URL of the cluster (e.g. https://localhost:9200) | — |
Basic (Username/Password)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "BASIC" | Yes | — | — |
| url | string | Yes | Base URL of the cluster (e.g. https://localhost:9200) | — |
API Key (Bearer Token)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "API_KEY" | Yes | — | — |
| url | string | Yes | Base URL of the cluster (e.g. https://localhost:9200) | — |
Secrets
Stored encrypted and never shown again after you save them. See Configuration & Fields.
This section depends on which authentication method you pick — one of the following applies.
No Authentication
Secret fields · No Authentication: none for this source.
Basic (Username/Password)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| username | string | Yes | Basic auth username | — |
| password | string | Yes | Basic auth password | — |
API Key (Bearer Token)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| api_key | string | Yes | API key or bearer token, sent as an Authorization header | — |
Optional
Everything you can tune. Sensible defaults apply when you leave them alone.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| optional | object | No | —no extra properties | — |
| connection | object | No | Cluster connection controls.no extra properties | — |
| connection.request_timeout_seconds | number | No | Network timeout in seconds for cluster API callsmin 1, max 300 | 30 |
| connection.verify_ssl | boolean | No | TLS certificate verification toggle | true |
| scope | object | No | Index selection scope.no extra properties | — |
| scope.exclude_indices | array | No | Index denylist | — |
| scope.exclude_indices[] | string | No | — | — |
| scope.include_indices | array | No | Optional index allowlist | — |
| scope.include_indices[] | string | No | — | — |
| scope.include_system_indices | boolean | No | Include system indices (names starting with .) | false |
| scope.index_limit | integer | No | Optional cap on number of index assetsmin 1 | — |