Docs
  • Guides
  • APIs (opens in a new tab)
  • Products
    Elasticsearch Observability Security Elastic Cloud
  • Reference
  • Troubleshoot
  • Release notes
  1. Docs /
  2. Guides /
  3. Extend and contribute /
  4. Contribute to Kibana /
  5. Testing /
  6. API and E2E tests

API testing with Scout

Use these pages when writing Scout API integration tests:

  • Write Scout API tests
  • API test best practices
  • Authentication in Scout API tests
Previous
A11y checks
Next
Write API tests
  • View as Markdown
  • Report a docs issue
  • Edit this page
  • Learn how to contribute
Get started free
  • 14-day free trial
  • All features included
  • No setup required
Section
Guides
Docs Guides APIs (opens in a new tab)
Products
Elasticsearch Observability Security Elastic Cloud
Reference Troubleshoot Release notes
Version
  • Elastic fundamentals
    • Evaluate Elastic during a trial
    • Solutions overview
    • Deployment options
    • The Elastic Stack
    • Versioning and availability
    • How to use the documentation
    • Glossary
  • Solutions and use cases
    • Search use case
      • Get started
        • Quickstarts
          • Index and search basics
          • Keyword search with Python
          • Semantic search
      • Ingest for search use cases
        • Ingest pipelines for search use cases
      • Search approaches
        • Full-text search
          • How full-text search works
          • Text analysis during search
          • Search relevance optimizations
            • Mixing exact search with stemming
            • Getting consistent scoring
            • Incorporating static relevance signals into the score
          • Search with synonyms
            • Create or update synonyms set API examples
        • Vector search
          • Use cases
          • Semantic search for text
            • Semantic search with semantic_text
            • Semantic search with the inference API
            • Semantic search with ELSER (ingest pipelines)
            • Using Cohere with Elasticsearch
            • Tutorial: Manual dense and sparse workflows
            • Using OpenAI compatible models
          • Multimodal search
            • Tutorial: Build multimodal search
          • Dense vector
            • kNN search in Elasticsearch
            • Bring your own dense vectors
            • Optimize vector storage for semantic search
          • Sparse vector search in Elasticsearch
        • Hybrid search
          • Hybrid search with semantic_text
        • Ranking and reranking
          • Semantic reranking
          • Learning To Rank (LTR)
            • Deploy and manage LTR models
            • Search using LTR
      • Build search queries
        • The _search API
        • The async-search API
        • ES|QL for search
        • Retrievers
        • Search templates
      • RAG
      • Add search to your app
        • Client libraries
        • Search UI
      • APIs and tools
    • Elasticsearch solution
      • Get started
        • AI onboarding
        • Find connection details
      • Agent Builder
      • Playground (deprecated)
        • Optimize model context
        • View and modify queries
        • Troubleshooting
      • Query rules UI
      • Search Applications
        • Search API and templates
        • Security
        • Search Application client guide
    • Observability solution
      • Get started
        • Elastic Observability quickstarts
          • Quickstart: Monitor hosts with OpenTelemetry
          • Quickstart: Monitor your application performance
          • Quickstart: Unified Kubernetes Observability with Elastic OpenTelemetry
          • Quickstart: Send OTLP data to Elastic Serverless or Elastic Cloud Hosted
          • Quickstart: Create a Synthetic Monitor
          • Quickstart: Monitor hosts with Elastic Agent
          • Quickstart: Monitor your Kubernetes cluster with Elastic Agent
          • Quickstart: Collect data with AWS Firehose
        • OpenTelemetry quickstarts
          • Ingest custom metrics with Elastic OpenTelemetry
          • Self-managed
            • Kubernetes
            • Hosts / VMs
            • Docker
          • Elastic Cloud Serverless
            • Kubernetes
            • Hosts and VMs
            • Docker
          • Elastic Cloud Hosted
            • Kubernetes
            • Hosts and VMs
            • Docker
        • OpenTelemetry use cases
          • Kubernetes observability
            • Prerequisites and compatibility
            • Components description
            • Deployment
            • Instrumenting Applications
            • Upgrade
            • Customization
          • LLM observability
          • Upstream OpenTelemetry Collector
        • Other Observability tutorials
          • Tutorial: Monitor a Java application
        • Logs Essentials
      • Applications and services
        • Application performance monitoring (APM)
          • Get started with traces and APM
          • Application data types
            • Spans
            • Transactions
              • Transaction sampling
            • Traces
            • Errors
            • Metrics
            • Metadata
          • Collect application data
            • OpenTelemetry
              • Contrib OpenTelemetry Collectors and language SDKs
              • Collect metrics
              • Create APM agent key for EDOT SDKs
              • Centrally configure EDOT SDKs
              • Limitations
              • Attributes and labels
              • Data stream routing
            • APM agents
              • Centrally configure APM agents
              • Real User Monitoring (RUM)
              • Create and upload source maps (RUM)
            • Kubernetes
            • AWS Lambda Functions
            • Jaeger (deprecated)
          • View and analyze data
            • Overviews
              • Services
              • Traces UI
              • Dependencies
              • Service Map
              • Service overview
              • Mobile service overview
            • Drill down into data
              • Transactions UI
              • Trace sample timeline
              • Errors UI
              • Metrics UI
              • Infrastructure
              • Logs
            • Explore traces in Discover
            • Filter and search data
              • Filters
              • Advanced queries
              • Cross-cluster search
            • Interpret data
              • Find transaction latency and failure correlations
              • Track deployments with annotations
              • Explore mobile sessions with Discover
              • Observe Lambda functions
            • Integrate with machine learning
            • APM Agent explorer
            • Settings
          • Act on data
            • Create rules and alerts
            • Create custom links
          • Use APM securely
            • Secure data
              • Control access to APM data
              • Built-in data filters
              • Custom filters
              • Delete sensitive data
            • Secure communication with APM agents
              • APM agent TLS communication
              • API keys
              • Secret token
              • Anonymous authentication
            • Secure communication with the Elastic Stack
              • Use feature roles
              • Grant access using API keys
            • Secure access to the Applications UI
              • Create an APM reader user
              • Create an annotation user
              • Create an API user
              • Create a central config user
              • Create a storage explorer user
          • Manage storage
            • Storage Explorer
            • Data streams
            • Index lifecycle management
            • View the Elasticsearch index template
            • Parse data using ingest pipelines
            • Storage and sizing guide
            • Reduce storage
            • Explore data in Elasticsearch
          • Work with APM Server
            • Set up
              • Fleet-managed APM Server
              • APM Server binary
            • Configure
              • General configuration options
              • Anonymous authentication
              • APM agent authorization
              • Configure APM Agent Central Configuration
              • Instrumentation
              • Kibana endpoint
              • Logging
              • Output
                • Elastic Cloud Hosted
                • Elasticsearch
                • Logstash
                • Kafka
                • Redis
                • Console
              • Project paths
              • Real User Monitoring (RUM)
              • SSL/TLS settings
                • SSL/TLS output settings
                • SSL/TLS input settings
              • Tail-based sampling
              • Use environment variables in the configuration
              • Advanced setup
                • Installation layout
                • Secrets keystore
                • Command reference
                • Tune data ingestion
                • High Availability
                • APM Server and systemd
            • Monitor
              • Fleet-managed
              • APM Server binary
                • Use internal collection
                • Use Metricbeat collection
                • Use local collection
          • APM APIs
            • APM UI API
            • APM Server API
              • APM Server information API
              • Elastic APM events intake API
              • Elastic APM agent configuration API
              • OpenTelemetry intake API
              • Jaeger event intake
            • Managed intake service event API
          • Upgrade
            • APM agent compatibility
            • Upgrade to version 9.0
              • Self-installation standalone
              • Self-installation APM integration
              • Elastic Cloud standalone
              • Elastic Cloud APM integration
            • Switch to the Elastic APM integration
              • Switch a self-installation
              • Switch an Elastic Cloud cluster
        • Synthetic monitoring
          • Get started
            • Use a Synthetics project
            • Use the Synthetics UI
          • Scripting browser monitors
            • Write a synthetic test
            • Configure individual monitors
            • Use the Synthetics Recorder
          • Configure lightweight monitors
          • Manage monitors
          • Work with params and secrets
          • Analyze monitor data
          • Monitor resources on private networks
          • Use the CLI
          • Configure a Synthetics project
          • Multi-factor Authentication
          • Kerberos authentication
          • Configure Synthetics settings
          • Grant users access to secured resources
            • Setup role
            • Writer role
            • Reader role
          • Manage data retention
          • Use Synthetics with network security
          • Migrate from the Elastic Synthetics integration
          • Scale and architect a deployment
          • Synthetics support matrix
          • Synthetics Encryption and Security
        • Real user monitoring
          • OpenTelemetry for Real User Monitoring (RUM)
        • LLM and agentic AI observability
        • Uptime monitoring (deprecated)
          • Get started
          • Analyze
            • View monitor status
            • Analyze monitors
            • Inspect uptime duration anomalies
          • Configure settings
        • Visualize OpenTelemetry data
      • CI/CD
      • Cloud
        • AWS
          • Ingestion options
          • Monitor AWS with Elastic Agent
            • EC2
            • Kinesis data streams
            • S3
            • SQS
          • Monitor AWS with Beats
          • Monitor AWS with Amazon Data Firehose
            • VPC Flow Logs
            • CloudTrail logs
            • Network Firewall logs
            • WAF logs
            • CloudWatch logs
          • Monitor AWS with Elastic Serverless Forwarder
        • Azure
          • Monitor Microsoft Azure with Elastic Agent
          • Monitor Microsoft Azure with Beats
          • Ingest multi-tenant Azure Event Hub logs with Filebeat
          • Monitor Microsoft Azure with the Azure Native Service
          • Monitor Microsoft Azure OpenAI
        • GCP
          • GCP Dataflow templates
      • Infrastructure and hosts
        • Analyze infrastructure and host metrics
          • Get started with system metrics
          • View infrastructure metrics by resource type
          • Explore metrics data with Discover in Kibana
          • Explore infrastructure metrics over time (deprecated)
          • Analyze and compare hosts
          • Detect metric anomalies
          • Configure settings
        • Universal Profiling
          • Get started
          • Manage data storage
            • Index lifecycle management
            • Configure probabilistic profiling
          • Advanced configuration
            • Tag data for querying
            • Add symbols for native frames
            • Use a proxy
            • Override kernel version check
            • Environment variables to configure the Universal Profiling Agent
            • Configuration file of the Universal Profiling Agent
          • Upgrade
          • Self-hosted infrastructure
          • Install the backend
            • Step 1: Update the stack
            • Step 2: Enable Universal Profiling in Kibana
            • Step 3: Set up Universal Profiling in Kibana
            • Step 4: Run the backend applications
            • Step 5: Next steps
          • Operate the backend
        • Network Topology
          • Tutorial: Monitor your network devices with the Network Topology plugin
          • Network Topology field reference
        • Tutorial: Observe your Kubernetes deployments
        • Tutorial: Observe your nginx instances
          • Understanding "no results found" message
        • Collect NGINX data with OpenTelemetry integrations (Fleet-managed)
        • Collect NGINX data with OpenTelemetry integrations (standalone)
      • Logs
        • Get started with system logs
        • Send any log file using Elastic Agent
        • Send any log file using OTel Collector
        • Send application log data
          • Plaintext application logs
          • ECS formatted application logs
          • APM agent log sending
        • Parse and route logs using ingest pipelines
        • Filter and aggregate logs
        • Explore logs
          • Explore logs in Discover
          • Categorize log entries
          • Inspect log anomalies
        • Run a pattern analysis on log data
        • Configure log data sources
        • Configure log data retention
        • Add a service name to logs
        • Logs index template reference
          • Default logs index template
      • Streams
        • Get data in
        • Organize data
        • Process documents
        • Configure data lifecycle
        • Manage data quality
        • Map fields
        • Configure advanced settings
        • Knowledge Indicators
        • Wired streams field naming
        • Streamlang
          • Append processor
          • Concat processor
          • Convert processor
          • Date processor
          • Dissect processor
          • Drop document processor
          • Enrich processor
          • Grok processor
          • Join processor
          • JSON extract processor
          • Lowercase processor
          • Math processor
          • Network direction processor
          • Redact processor
          • Registered domain processor
          • Remove processor
          • Rename processor
          • Replace processor
          • Set processor
          • Sort processor
          • Split processor
          • Trim processor
          • Uppercase processor
          • URI parts processor
          • User agent processor
          • Manual pipeline configuration
      • Incident management
        • Alerting
          • Create and manage rules
            • Anomaly detection
            • APM anomaly
            • Custom threshold
            • Degraded docs
            • Elasticsearch query
            • Error count threshold
            • Failed transaction rate threshold
            • Failed docs
            • Inventory
            • Latency threshold
            • Log threshold
            • Metric threshold
            • Monitor Status
            • TLS certificate
            • Uptime duration anomaly
            • SLO burn rate
          • Aggregation options
            • Rate aggregation
          • View and manage alerts
            • SLO burn rate breaches
            • Threshold breaches
        • Cases
        • Service-level objectives (SLOs)
          • Configure SLO access
          • Create an SLO
          • Create a composite SLO
          • View and manage SLOs
          • Configure SLOs settings
      • Data set quality
      • AI for Observability
        • Agent Builder for Observability
        • AI Assistant
        • Automatic Import
        • Large language model performance matrix for Observability
      • Cross-project search
      • Serverless feature tiers
      • APIs
    • Security solution
      • Get started
        • Elastic Security quickstarts
          • Detect and respond to threats with SIEM
          • Protect your hosts with endpoint security
          • Secure your cloud assets with cloud security posture management
        • Elastic Security requirements
        • Elastic Security UI
        • Ingest data to Elastic Security
          • Enable threat intelligence integrations
          • Automatic migration
          • Automatic Import
          • Content connectors
        • Spaces and Elastic Security
          • Spaces and Elastic Defend FAQ
        • Data views and Elastic Security
        • Create runtime fields in Elastic Security
        • Configure advanced settings
        • SIEM Readiness
      • ES|QL for security
        • Tutorial: Threat hunting with ES|QL
      • AI for security
        • Elastic AI SOC Engine
          • Triage alerts
          • Upgrade from EASE to Elastic Security
        • Agent Builder for Elastic Security
          • Agents, skills, and tools
          • Security use cases
        • AI Assistant for Security
          • AI Assistant Knowledge Base
          • Use AI Assistant's Knowledge Base to improve response quality
        • Attack Discovery
          • Grant feature access
          • Run Attack Discovery
            • Run from Attacks view
              • Configure Attack Discovery settings
              • Manual runs
              • Scheduled runs
              • Troubleshoot with AI
            • Run from a workflow
            • Run from Agent Builder
            • Run from Attack Discovery page
          • Triage Attack Discovery findings
          • Manage saved discoveries
            • Manage from Attacks view
            • Manage from Attack Discovery page
        • Large language model performance matrix for Elastic Security
        • AI use cases
          • Triage alerts
          • Identify, investigate, and document threats
          • Generate, customize, and learn about ES|QL queries
        • Value report
      • Security MCP App
      • Detections and alerts
        • Before you begin
          • Turn on detections
          • Detections privileges
          • Detection rule concepts
          • Advanced data source configuration
            • Cross-cluster search and detection rules
            • Cross-project search and detection rules
            • Using logsdb index mode with Elastic Security
        • MITRE ATT&CK coverage
          • Remap to MITRE ATT&CK v19
        • Prebuilt rules
          • Prebuilt rule components
          • Install prebuilt rules
          • Update prebuilt rules
          • Prebuilt rules in air-gapped environments
          • Customize prebuilt rules
        • Author rules
          • Choose the right rule type
            • About building block rules
          • Rule type guides
            • ES|QL rules
            • Custom query rules
            • Event correlation (EQL) rules
            • Indicator match rules
            • Threshold rules
            • Machine learning rules
            • New terms rules
          • Using the UI
          • Using the API
          • Common rule settings
          • Set rule data sources
          • Write investigation guides
          • Validate and test rules
        • Manage detection rules
          • View rule changes history
        • Monitor rule executions
          • Fill rule execution gaps
        • Reduce noise and false positives
          • Tune detection rules
          • Rule exceptions
            • Create and manage value lists
            • Add and manage exceptions
            • Create and manage shared exception lists
          • Suppress detection alerts
        • Manage detection alerts
          • Visualize detection alerts
          • View detection alert details
          • Query alert indices
      • Configure endpoint protection with Elastic Defend
        • Elastic Defend requirements
        • Install Elastic Defend
          • Enable access on macOS
          • Deploy on macOS with MDM
          • Prevent Elastic Agent uninstallation
        • Elastic Defend feature privileges
        • Configure an integration policy for Elastic Defend
          • Configure updates for protection artifacts
          • Turn off diagnostic data for Elastic Defend
          • Configure self-healing rollback for Windows endpoints
          • Configure Linux file system monitoring
          • Configure data volume
          • Create an Elastic Defend policy using API
        • Configure offline endpoints and air-gapped environments
        • Remote output and cross-cluster search
        • Uninstall Elastic Agent
      • Manage Elastic Defend
        • Endpoints
        • Policies
        • Elastic Endpoint exceptions
        • Trusted applications
        • Trusted devices
        • Event filters
        • Host isolation exceptions
        • Blocklist
        • Exception types and syntax
        • Optimize Elastic Defend
        • Event capture and Elastic Defend
        • Endpoint protection rules
        • Automatic troubleshooting
        • Allowlist Elastic Endpoint in third-party antivirus apps
        • Elastic Endpoint self-protection features
      • Endpoint response actions
        • Automated response actions
        • Isolate a host
        • Response actions history
        • Script library
        • Third-party response actions
        • Configure third-party response actions
      • Cloud Security
        • Security posture management overview
        • Enable cloud security features in Serverless
        • Cloud security posture management
          • Get started with CSPM for AWS
          • Get started with CSPM for GCP
          • Get started with CSPM for Azure
          • CSPM privilege requirements
          • CSPM Findings
          • CSPM benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Kubernetes security posture management
          • Get started with KSPM
          • KSPM Findings
          • KSPM benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Cloud Asset Discovery
          • Set up Cloud Asset Discovery for AWS
          • Set up Cloud Asset Discovery for GCP
          • Set up Cloud Asset Discovery for Azure
        • Cloud native vulnerability management
          • Get started with CNVM
          • CNVM privilege requirements
          • CNVM Findings
          • CNVM dashboard
          • Frequently asked questions (FAQ)
        • Cloud workload protection for VMs
          • Capture environment variables
        • Cloud workload protection for Kubernetes
          • Get started with Defend for Containers for Kubernetes
          • Container workload protection policies
          • Kubernetes dashboard
      • Ingest third-party security data
        • AWS Config
        • AWS Inspector
        • AWS Security Hub
        • AWS Security Hub CSPM
        • CNCF Falco
        • Google Security Command Center
        • Microsoft Defender for Cloud
        • Microsoft Defender for Endpoint
        • Microsoft Defender XDR
        • Prisma Cloud
        • Qualys VMDR
        • Rapid7 InsightVM
        • Tenable VM
        • Wiz
      • Investigation tools
        • Explore Security data in Discover
        • Timeline
          • Timeline templates
        • Visual event analyzer
        • Session View
        • Osquery
          • Osquery manager integration
          • Osquery FAQ
          • Add Osquery Response Actions
          • Run Osquery from investigation guides
          • Run Osquery from alerts
          • Examine Osquery results
          • Use placeholder fields in Osquery queries
        • Notes
        • Indicators of compromise
        • Cases
      • Dashboards
        • Overview dashboard
        • Detection & Response dashboard
        • Cloud Security Posture dashboard
        • Kubernetes dashboard
        • Entity Analytics dashboard
        • Data Quality dashboard
        • Cloud Native Vulnerability Management Dashboard
        • Detection rule monitoring dashboard
        • Endpoint Detection and Response dashboard
      • Entity analytics
        • Entity analytics requirements
        • Entity store
          • Entity relationships
        • Entity risk scoring
          • Turn on risk scoring
          • Asset criticality
          • View and analyze risk score data
        • Manage entities
          • Watchlists
          • Entity resolution
          • Privileged user monitoring
            • Privileged user monitoring requirements
            • Set up privileged user monitoring
            • Monitor privileged user activities
        • Advanced behavioral detections
          • Machine learning job and rule requirements
          • Anomaly detection
          • Optimizing anomaly results
          • Behavioral detection use cases
        • Investigate entities
          • Monitor entity risk
          • View entity details
        • Explore
          • Hosts page
          • Network page
            • Configure network map data
            • Configure the DNS histogram
          • Users page
      • Serverless feature tiers
      • APIs
  • Manage data
    • The Elasticsearch data store
      • Index fundamentals
      • Near real-time search
      • Data streams
        • Set up a data stream
        • Use a data stream
        • Modify a data stream
        • Manage a data stream in Kibana
        • Time series data streams
          • Quickstart
          • Set up a TSDS
          • Downsampling
            • Concepts
            • Configuration
            • Querying
          • Advanced topics
            • Time-bound indices
            • Metric temporality
            • Reindex a TSDS
            • OTLP/HTTP endpoint
            • Prometheus remote write endpoint
        • Logs data streams
          • Configure a logs data stream
          • Enable logsdb for integrations
        • Failure store
          • Using failure stores to address ingestion issues
      • Columnar storage
      • Mapping
        • Dynamic mapping
          • Dynamic field mapping
          • Dynamic templates
        • Explicit mapping
        • Runtime fields
          • Map a runtime field
          • Define runtime fields in a search request
          • Override field values at query time
          • Retrieve a runtime field
          • Index a runtime field
          • Explore your data with runtime fields
        • Removal of mapping types
        • Update mapping API examples
      • Text analysis
        • Concepts
          • Anatomy of an analyzer
          • Index and search analysis
          • Stemming
          • Token graphs
        • Configure text analysis
          • Test an analyzer
          • Configuring built-in analyzers
          • Create a custom analyzer
          • Specify an analyzer
      • Templates
        • Simulate multi-component templates
        • Ignore missing component templates
      • Aliases
      • Manage indices in Kibana
        • Index operations reference
      • Manage data using APIs
    • Ingest: Bring your data to Elastic
      • Ingesting time series data
      • Ingesting data for Elastic solutions
      • Ingesting data from applications
        • Ingest data with Node.js
        • Ingest data with Python
        • Ingest data from Beats with Logstash as a proxy
        • Ingest data from a relational database
        • Ingest logs from a Python application using Filebeat
        • Ingest logs from a Node.js web application using Filebeat
      • Ingest architectures
        • Elastic Agent to Elasticsearch
          • Elastic Agent to Elasticsearch: Agent installed
          • Elastic Agent to Elasticsearch: APIs for collection
        • Elastic Agent to Logstash to Elasticsearch
          • Elastic Agent to Logstash (for enrichment) to Elasticsearch
          • Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering
          • Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy
          • Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations
        • Elastic Agent to proxy to Elasticsearch
        • Elastic Agent to Elasticsearch with Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Logstash to Elasticsearch: Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Kafka ES Sink to Elasticsearch: Kafka as middleware message queue
        • Logstash to Elasticsearch
        • Elastic air-gapped architectures
          • Elastic Agent to Elasticsearch: Air-gapped environment
          • Elastic Agent to Logstash: Air-gapped environment
      • Elastic Managed integrations
        • Enable an Elastic Managed integration
        • Cloud connector authentication
        • FAQ
      • OTLP/HTTP endpoint
      • Sample data
      • Upload data files
      • Transform and enrich data
        • Calculate the ingest lag metadata
        • Elasticsearch ingest pipelines
          • Example
          • Create readable and maintainable ingest pipelines
          • Error handling
        • Logstash pipelines
        • Data enrichment
          • Set up an enrich processor
          • Example: Enrich your data based on geolocation
          • Example: Enrich your data based on exact values
          • Example: Enrich your data by matching a value to a range
        • Index mapping and text analysis
      • Ingest tools overview
    • Data lifecycle
      • Data tiers
        • Manage data tiers in ECH or ECE
        • Manage data tiers in self-managed and ECK
      • Index lifecycle management
        • ILM phases and actions
        • Index rollover and routing allocation
          • Skip rollover
        • Create an ILM policy
        • Apply a policy to an existing index
        • Check the ILM status of indices and data streams
        • Manage the lifecycle policy for integrations data
        • Update or switch an index lifecycle policy
        • Start and stop ILM
        • Restore managed indices and manage ILM actions
        • ILM automation tutorials
          • Manage time series data with data streams
          • Manage time series data without data streams
          • Manage general content with data streams
          • Customize built-in ILM policies
        • Migrate to ILM
          • Migrate to ILM (ECH or ECE)
          • Migrate to ILM (self-managed and ECK)
          • Migrate index allocation filters to ILM node roles
      • Data stream lifecycle
        • Creating a data stream with a lifecycle
        • Update the lifecycle of a data stream
        • Setting retention for Elasticsearch data streams
        • Searchable snapshots
        • Migrating ILM-managed data streams to data stream lifecycle
      • Curator
      • Rollup
        • Get started using the API
        • Get started in Kibana
        • Rollup groups and configuration
        • Rollup aggregation limitations
        • Rollup search limitations
        • Migrating to downsampling
    • Migrate your Elasticsearch data
      • Migrate data using snapshots
      • Migrate data using the reindex API
        • Reindex using a private CA
      • Migrate data using Logstash
      • Migrate system indices
    • Use case: Use Elasticsearch to manage time series data
  • Explore and analyze
    • Learn data exploration and visualization
    • Querying and filtering
      • Query languages
        • Query DSL
        • ES|QL
        • SQL
        • EQL
          • Example: Detect threats with EQL
        • KQL
        • Lucene query syntax
      • Query tools
        • Saved queries
        • Console
        • Search profiler
        • Grok debugger
      • Aggregations
        • Basics
      • Filtering in Kibana
    • Geospatial analysis
    • Transforming data
      • Overview
      • Setup
      • When to use transforms
      • Generating alerts for transforms
      • Transforms at scale
      • How checkpoints work
      • API quick reference
      • Tutorial: Transforming the eCommerce sample data
      • Examples
      • Painless examples
      • Limitations
    • Elastic Inference
      • Elastic Inference Service (EIS)
        • Supported models
        • Region and hosting
        • Rate limits
        • EIS for self-managed clusters
      • External inference
      • Default endpoints, adaptive allocations, and chunking
    • Machine learning
      • Setup and security
      • Anomaly detection
        • Finding anomalies
          • Plan your analysis
          • Run a job
          • View the results
          • Forecast future behavior
        • Tutorial
        • Advanced concepts
          • Anomaly detection algorithms
          • Anomaly score explanation
          • Job types
          • Working with anomaly detection at scale
          • Handling delayed data
          • Daylight saving time calendars
        • API quick reference
        • How-tos
          • Generating alerts for anomaly detection jobs
          • Aggregating data for faster performance
          • Altering data in your datafeed with runtime fields
          • Customizing detectors with custom rules
          • Detecting anomalous categories of data
          • Performing population analysis
          • Reverting to a model snapshot
          • Detecting anomalous locations in geographic data
          • Mapping anomalies by location
          • Adding custom URLs to machine learning results
          • Anomaly detection jobs from visualizations
        • Resources
          • Limitations
          • Analysis function reference
          • Supplied configurations
          • Troubleshooting and FAQ
      • Data frame analytics
        • Overview
        • Finding outliers
        • Predicting numerical values with regression
        • Predicting classes with classification
        • Advanced concepts
          • How data frame analytics analytics jobs work
          • Working with data frame analytics at scale
          • Adding custom URLs to data frame analytics jobs
          • Feature encoding
          • Feature processors
          • Feature importance
          • Loss functions for regression analyses
          • Hyperparameter optimization
          • Trained models
        • API quick reference
        • Resources
          • Limitations
      • NLP
        • Overview
          • Extract information
          • Classify text
          • Search and compare text
        • Deploy trained models
          • Select a trained model
          • Import the trained model and vocabulary
          • Deploy the model in your cluster
          • Try it out
        • Add NLP inference to ingest pipelines
        • API quick reference
        • Built-in NLP models
          • ELSER
          • Jina
          • Elastic Rerank
          • E5
          • Language identification
        • Compatible third party models
        • Examples
          • End-to-end tutorial
          • Named entity recognition
          • Text embedding and semantic search
        • Limitations
      • ML in Kibana
        • AIOps Labs
        • Inference processing
    • Scripting
      • Painless
        • How to write Painless scripts
          • Write your first script
          • Use parameters
          • Shorten scripts
          • Store and retrieve scripts
          • Update documents using scripts
        • Painless script tutorials
          • Accessing document fields and special variables
          • Accessing fields in a document
          • Converting data types
          • Dissecting data
          • Extracting fields
          • Grokking grok
          • Scripts, caching, and search speed
          • Updating documents
          • Using Painless regular expressions
          • Working with dates
        • Painless syntax-context bridge
        • Scripting and security in Painless
        • Painless lab
        • Debugging Painless scripts
          • Array manipulation errors
          • Date math errors
          • Field not found errors
          • Ingest pipeline failures
          • Null pointer exceptions
          • Regex pattern matching failures
          • Runtime field exceptions
          • Sandbox limitations
          • Script score calculation errors
          • Subfield access
          • Type casting issues
      • Lucene expressions language
      • Implementing custom scripting language in Elasticsearch
    • Cross-cluster search
      • Resolve a cluster before cross-cluster search
    • Cross-project search
      • Search
      • Tags
      • Project routing
      • CPS scope in project apps
      • CPS in ES|QL
    • AI-powered features
      • Automatic Import
      • Agent Builder
        • Get started
        • Models
        • Chat
          • Chat UI modes
          • Dashboards and visualizations
        • Agents
          • Custom agents
          • Built-in agents
          • Prompting best practices
          • Connect agents and workflows
        • Skills
          • Built-in skills
          • Custom skills
          • Skill creation guidelines
        • Plugins
        • Tools
          • Built-in tools
          • Custom tools
            • ES|QL tools
            • Index search tools
            • MCP tools
            • Workflow tools
        • Connectors
        • Programmatic access
          • Kibana APIs
            • Kibana API tutorial
          • A2A server
          • MCP server
            • API key authentication
            • OAuth authentication
        • Monitor usage and costs
          • Collect agent traces
          • Overview dashboard
          • Create alerts on trace data
        • Permissions
        • Troubleshooting
          • Context length exceeded
          • 403 Forbidden
        • Limitations
        • Glossary
      • AI chat experiences
        • Compare Agent Builder and AI Assistant
        • AI assistants
        • Knowledge base artifact repo for AI Assistant
      • Manage access to AI features
      • AI agent skills
      • Configure access to LLMs
        • Connect to Azure OpenAI
        • Connect to Amazon Bedrock
        • Connect to OpenAI
        • Connect to Google Vertex
        • Self-managed custom LLMs
          • Connect to LM Studio for Observability
          • Connect to LM Studio for Elastic Security
          • Connect to vLLM for Elastic Security
    • Discover
      • Explore fields and data with Discover
      • Customize the Discover view
      • Search for relevance
      • Save a Discover session for reuse
      • View field statistics
      • Run a pattern analysis on your log data
      • Detect change points
      • Run queries in the background
      • Using ES|QL
    • Dashboards
      • Exploring dashboards
      • Building dashboards
        • Create from the UI
        • Create programmatically
        • Create using AI
        • Edit a dashboard
        • Add drilldowns
        • Organize dashboard panels
        • Duplicate a dashboard
      • Managing dashboards
        • Share and export dashboards
        • Import a dashboard
        • Manage as code
      • Tutorials
        • Create a simple dashboard to monitor website logs
        • Create a dashboard with time series charts
    • Panels and visualizations
      • Visualizations
        • Area charts
        • Bar charts
        • Heat map charts
        • Gauge charts
        • Line charts
        • Metric charts
        • Mosaic charts
        • Pie charts
        • Region map charts
        • Tables
        • Waffle charts
        • Tag cloud charts
        • Treemap charts
      • Visualizations (ES|QL query)
      • Custom visualizations with Vega
      • Text panels
      • Image panels
      • Link panels
      • Alert panels
      • Controls
        • Add controls
        • Add time slider controls
        • Add variable controls
        • Control settings
      • Canvas
        • Edit workpads
        • Present your workpad
        • Tutorial: Create a workpad for monitoring sales
        • Canvas function reference
          • TinyMath functions
      • Maps
        • Build a map to compare metrics by country or region
        • Track, visualize, and alert on assets in real time
        • Map custom regions with reverse geocoding
        • Heat map layer
        • Tile layer
        • Vector layer
          • Vector styling
          • Vector style properties
          • Vector tooltips
        • Plot big data
          • Clusters
          • Display the most relevant documents per entity
          • Point to point
          • Term join
        • Search geographic data
          • Create filters from a map
          • Filter a single layer
          • Search across multiple indices
        • Configure map settings
        • Connect to Elastic Maps Service
        • Import geospatial data
          • Clean your data
          • Tutorial: Index GeoJSON data
        • Troubleshoot
      • Graph
        • Configure Graph
        • Troubleshooting and limitations
      • Legacy editors
        • Aggregation-based
        • TSVB
        • Timelion
      • Visualize Library
      • Manage panels
    • Find and organize content
      • The Kibana interface
      • Data views
      • Saved objects
      • Files
      • Reports
      • Tags
      • Find apps and objects
      • Customize your navigation menu
    • Reporting and sharing
      • Automatically generate reports
      • Troubleshoot reporting
        • CSV
        • PDF/PNG
    • Alerting
      • Compare alerting systems
      • Experimental alerting system
        • How it works
        • Glossary
        • Get started
          • Set up
          • Configure access
          • Create your first rule
        • Authorization
        • Rules
          • Create a rule
            • Create an ES|QL rule
              • YAML rule schema reference
            • Create rules using Agent Builder
            • Create rules using the rule builder
            • Create from Discover
          • Configure a rule
            • Rule mode
            • ES|QL query
            • Schedule and lookback
            • Severity
            • Grouping
            • Alert delay (Alert mode only)
            • Recovery condition
            • No-data handling
            • Tags and runbooks (Alert mode only)
          • View and manage rules
          • Review rule execution history
          • ES|QL query patterns
            • Your first rule query
            • Threshold queries
            • No-data detection
            • SLO burn rate
            • Persistent breach detection
          • Rule events
        • Alerts
          • Alert data model
          • View and manage alerts
            • Triage alert episodes
            • Investigate alert episodes
          • Query alert history
          • Field reference
        • Notifications and actions
          • Connect workflows
          • About action policies
          • Examples and common scenarios
            • Route by severity
            • Severity escalation
            • Re-notification
          • Create an action policy
          • Action policy reference
          • Manage action policies
          • Review action policy execution history
          • Reduce notification noise
      • Kibana alerting
        • Getting started with alerts
        • Set up
        • Rules and Elastic Cloud API keys in Serverless
        • Create and manage rules
        • View and manage alerts
        • Query alert indices
        • Rule types
          • Index threshold
          • Elasticsearch query
          • Tracking containment
        • Rule action variables
        • Notifications domain allowlist
        • Troubleshooting and limitations
          • Common issues
          • Troubleshoot rule behavior
          • Event log index
          • Test connectors
        • Maintenance windows
      • Watcher
        • Getting started with Watcher
        • How Watcher works
        • Enable Watcher
        • Watcher UI
        • Encrypting sensitive data in Watcher
        • Inputs
          • Simple input
          • Search input
          • HTTP input
          • Chain input
        • Triggers
          • Schedule trigger
          • Throttling
          • Schedule Types
        • Conditions
          • Always condition
          • Never condition
          • Compare condition
          • Array compare condition
          • Script condition
        • Actions
          • Running an action for each element in an array
          • Adding conditions to actions
          • Email action
          • Webhook action
          • Index action
          • Logging action
          • Slack action
          • PagerDuty action
          • Jira action
        • Transforms
          • Search payload transform
          • Script payload transform
          • Chain payload transform
        • Managing watches
        • Example watches
          • Watching the status of an Elasticsearch cluster
          • Execute a watch
        • Limitations
    • Cases
      • Control access
      • Create cases
      • Manage cases
      • Analyze with AI
      • Attach objects
      • Search and share
      • Configure settings
      • Case templates
        • Create field library fields
        • Create templates
        • Edit and share templates
        • YAML schema reference
      • Case analytics
        • Indices
        • Explore and visualize
        • Query with ES|QL
        • Analyze fields
        • Field reference
        • Administer
    • Workflows
      • Get started
        • Set up Workflows
        • Build your first workflow
      • Use cases
        • Security
          • Automate security operations
            • Alert analysis workflow
            • Triage alerts into cases
            • AI-driven alert triage
            • Enrich with threat intel
          • Manage detection rules at scale
            • Run rules on demand
        • Observability
          • Root cause analysis
        • AI-augmented workflows
          • Classify and route alerts
      • Concepts
        • Managed workflows
        • Authorization
        • Triggers
          • Manual triggers
          • Scheduled triggers
          • Alert triggers
          • Event-driven triggers
        • Steps
          • Action steps
            • Elasticsearch
            • Kibana
            • Cases
            • Entity store
            • Security
              • Detection rules
              • Alert triage
              • Attack triage
            • Streams
            • External systems and apps
          • Flow control
            • If
            • Foreach
            • While
            • Switch
            • Parallel
            • Wait
            • Wait for input
            • Wait for approval
            • Loop break
            • Loop continue
          • AI
          • Data
          • Composition
        • Templating engine
        • Reference
          • Cheat sheet
          • Context variables
          • Glossary
          • Liquid filters
          • Step type index
      • Workflow authoring techniques
        • Use natural language
        • Use the YAML editor
        • Anatomy of a workflow
        • Workflow settings
        • Choose the right step
        • Pass data and handle errors
        • Compose workflows
        • Human-in-the-loop
        • Monitor workflow execution
        • Manage and organize workflows
        • Troubleshooting
        • Migrate workflows from 9.3 to 9.4
      • Workflow templates
        • Start from a template
    • Numeral formatting
  • Deploy and manage
    • Deploy
      • Detailed deployment comparison
      • Elastic Cloud
        • Compare Cloud Hosted and Serverless
        • Sign up
          • Subscribe from a marketplace
            • Upgrade a trial to a marketplace subscription
            • AWS Marketplace
            • Azure Native Service
              • Logs and metrics
              • Network security
              • Troubleshooting
            • Google Cloud Platform Marketplace
            • Heroku
              • Install the add-on
                • Remove the add-on
              • Access the console
              • Work with Elasticsearch
              • Migrate between plans
              • Hardware
              • Regions
        • Elastic Cloud Serverless
          • Create a serverless project
          • Regions
          • Project settings
          • Manage projects with API
        • Elastic Cloud Hosted
          • Create an Elastic Cloud Hosted deployment
            • Available stack versions
          • Access Kibana
          • Plan for production
          • Manage deployments
            • Configure
              • Manage hardware profiles
                • Customize instance configuration
              • Customize deployment components
              • Edit Elastic Stack settings
              • Add plugins and extensions
                • Provided with ECH
                • Custom plugins and bundles
                • Manage through API
              • Custom endpoint aliases
            • Manage Integrations Server
              • Switch from APM to Integrations Server
            • Find your Cloud ID
          • vCPU boosting and credits
          • Manage deployments using the Elastic Cloud API
          • Keep track of deployment activity
          • Restrictions and known problems
        • FedRAMP authorized Cloud offerings
        • Tools and APIs
      • Elastic Cloud Enterprise
        • Service-oriented architecture
        • Install an orchestrator
          • Prepare your environment
            • Hardware prerequisites
            • Software prerequisites
            • System configuration
            • Networking prerequisites
            • Users and permissions prerequisites
            • High availability
            • Separation of roles
            • Load balancers
            • JVM heap size
            • Wildcard DNS record and certificates
          • Install ECE
            • Identify the deployment scenario
            • Configure your operating system
              • Ubuntu
              • RHEL
              • SUSE
            • Installation procedures
              • Deploy a small installation
              • Deploy a medium installation
              • Deploy a large installation
              • Deploy using Podman
              • Migrate ECE to Podman hosts
                • Migrating to Podman 5
            • Post-installation steps
            • Install ECE on additional hosts
              • Manage roles tokens
            • Ansible playbook
            • Statistics collected by Elastic Cloud Enterprise
          • Air-gapped install
            • With your private Docker registry
            • Without a private Docker registry
            • Available Docker images
          • Configure ECE
            • Assign roles to hosts
            • System deployments configuration
              • Default system deployment versions
            • Manage deployment templates
              • Tag your allocators
              • Edit instance configurations
              • Create instance configurations
              • Create templates
              • Configure default templates
              • Configure index management
              • Data tiers and autoscaling support
              • Integrations server support
              • Default instance configurations
            • Change the ECE API URL
            • Change endpoint URLs
            • Enable custom endpoint aliases
            • Manage your allocators capacity
            • Configure allocator affinity
            • Change allocator disconnect timeout
            • Manage Elastic Stack versions
            • Include additional Kibana plugins
        • Log into the Cloud UI
        • Manage deployments
          • Deployment templates
          • Create a deployment
          • Access Kibana
          • Connect to Elasticsearch
          • Configure
            • Customize deployment components
            • Edit stack settings
              • Elasticsearch user settings
              • Kibana user settings
              • APM user settings
              • Enterprise search user settings
            • Resize deployment
            • Add plugins and extensions
            • Add custom bundles and plugins
            • Custom endpoint aliases
            • Resource overrides
            • Advanced cluster configuration
          • Search and filter deployments
          • Keep track of deployment activity
          • Manage Integrations Server
            • Enable Integrations Server through the API
            • Switch from APM to Integrations Server
        • Tools and APIs
      • Elastic Cloud on Kubernetes
        • Deploy an orchestrator
          • Install
            • YAML manifests
            • Helm chart
            • Required RBAC permissions
            • Deploy ECK on Openshift
              • Deploy the operator
              • Deploy an Elasticsearch instance with a route
              • Deploy a Kibana instance with a route
              • Deploy Docker images with anyuid SCC
              • Grant privileged permissions to Beats
              • Grant host access permission to Elastic Agent
            • Deploy ECK on GKE Autopilot
            • Deploy ECK on Google Distributed Cloud air-gapped
            • FIPS compatibility
          • Air-gapped environments
          • Configure
            • Apply configuration settings
            • Dynamic namespace handling
            • Configure the validating webhook
            • Restrict cross-namespace resource associations
            • Service meshes
              • Istio
              • Linkerd
            • Webhook namespace selectors
        • Manage deployments
          • Deploy an Elasticsearch cluster
          • Deploy a Kibana instance
          • Elastic Stack Helm chart
          • Applying updates
          • Accessing services
          • Configure deployments
            • Elasticsearch configuration
              • Nodes orchestration
              • Storage recommendations
              • Node configuration
              • Volume claim templates
              • Virtual memory
              • Settings managed by ECK
              • Custom configuration files and plugins
              • Init containers for plugin downloads
              • Update strategy
              • Pod disruption budget
              • Advanced Elasticsearch node scheduling
              • Readiness probe
              • Pod PreStop hook
              • Security context
              • Requests routing to Elasticsearch nodes
            • Kibana configuration
              • Connect to an Elasticsearch cluster
              • Advanced configuration
              • Install Kibana plugins
            • Customize pods
            • Propagate labels and annotations
            • Pause orchestration
            • Manage compute resources
            • Recipes
            • Connect to external Elastic resources
            • Elastic Stack configuration policies
        • Orchestrate other Elastic applications
          • APM server
            • Use an Elasticsearch cluster managed by ECK
            • Advanced configuration
            • Connect to the APM Server
          • Standalone Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
          • Fleet-managed Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
            • Known limitations
          • Elastic Maps Server
            • Deploy Elastic Maps Server
            • Map data
            • Advanced configuration
            • Elastic Maps HTTP configuration
          • Beats
            • Quickstart
            • Configuration
            • Configuration examples
            • Troubleshooting
          • Logstash
            • Quickstart
            • Configuration
            • Securing Logstash API
            • Logstash plugins
            • Configuration examples
            • Update strategy
            • Advanced configuration
          • Elastic Package Registry
        • Create custom images
        • Tools and APIs
      • Self-managed cluster
        • Install Elasticsearch
          • Local installation (quickstart)
          • Important system configuration
            • Elasticsearch service user requirements
            • Configuration methods
            • Disable swapping
            • Increase the file descriptor limit
            • Increase virtual memory
            • Increase max number of threads
            • Ensure JNA temporary directory permits executables
            • Decrease the TCP retransmission timeout
            • Synchronize system clocks
            • Bootstrap checks
          • Install on Linux or MacOS
          • Install on Windows
          • Install with Debian package
          • Install with RPM package
          • Install with Docker
            • Single-node cluster
            • Multi-node cluster
            • Production settings
            • Configure
        • Configure Elasticsearch
          • Important settings configuration
          • Add plugins
        • Install Kibana
          • Linux and MacOS
          • Windows
          • Debian
          • RPM
          • Docker
        • Configure Kibana
        • Access Kibana
        • Air gapped install
        • Tools and APIs
        • Tutorials
          • Install a self-managed Elastic Stack
          • Customize TLS certificates for a self-managed Elastic Stack
    • Distributed architecture
      • Clusters, nodes, and shards
        • Node roles
      • Reading and writing documents
      • Shard allocation, relocation, and recovery
        • Shard allocation awareness
        • Index-level shard allocation
          • Delaying allocation when a node leaves
      • The shard request cache
      • Discovery and cluster formation
        • Discovery
        • Quorum-based decision making
        • Voting configurations
        • Bootstrapping a cluster
        • Cluster state
        • Cluster fault detection
      • Kibana task management
    • Production guidance
      • Run Elasticsearch in production
        • Design for resilience
          • Resilience in small clusters
          • Resilience in larger clusters
          • Resilience in ECH and ECE
        • Scaling considerations
        • Performance optimizations
          • General recommendations
          • Tune for indexing speed
          • Tune for search speed
          • Tune approximate kNN search
          • Tune for disk usage
          • Size your shards
      • Run Kibana in production
        • High availability and load balancing
        • Configure memory
        • Manage background tasks
        • Traffic scaling considerations
        • Optimize alerting performance
        • Reporting production considerations
    • Reference architectures
      • Hot/Frozen - High Availability
      • GenAI Search - High Availability
    • Stack settings
    • Backup, high availability, and resilience tools
      • Snapshot and restore
        • Manage snapshot repositories
          • Self-managed
            • Azure repository
            • Google Cloud Storage repository
            • S3 repository
            • Shared file system repository
            • Read-only URL repository
            • Source-only repository
          • Elastic Cloud Hosted
            • AWS S3
            • Google Cloud Storage
            • Azure Blob Storage
            • Access isolation for the found-snapshots repository
              • Azure
              • AWS and GCP
          • Elastic Cloud Enterprise
            • AWS S3
            • Google Cloud Storage
            • Azure Storage repository
            • MinIO self-managed repository
          • Elastic Cloud on Kubernetes
        • Create, monitor and delete snapshots
        • Restore a snapshot
          • Restore a snapshot across clusters
            • Restore snapshot into a new deployment
            • Restore snapshot into an existing deployment
            • Restore snapshots containing searchable snapshots indices across clusters
        • Searchable snapshots
      • Cross-cluster replication
        • Set up cross-cluster replication
          • Prerequisites
          • Connect to a remote cluster
          • Configure privileges for cross-cluster replication
          • Create a follower index to replicate a specific index
          • Create an auto-follow pattern to replicate time series indices
        • Manage cross-cluster replication
          • Inspect replication statistics
          • Pause and resume replication
          • Recreate a follower index
          • Terminate replication
        • Manage auto-follow patterns
          • Create auto-follow patterns
          • Retrieve auto-follow patterns
          • Pause and resume auto-follow patterns
          • Delete auto-follow patterns
        • Upgrading clusters
          • Uni-directional index following
          • Bi-directional index following
        • Uni-directional disaster recovery
          • Prerequisites
          • Failover when clusterA is down
          • Failback when clusterA comes back
        • Bi-directional disaster recovery
          • Initial setup
          • Failover when clusterA is down
          • Failback when clusterA comes back
          • Perform update or delete by query
    • Autoscaling
      • In ECE and ECH
      • In ECK
      • Autoscaling deciders
      • Trained model autoscaling
    • Cloud Connect
    • Security
      • Secure your orchestrator
        • Elastic Cloud Enterprise
          • Manage security certificates
          • Allow x509 Certificates Signed with SHA-1
          • Configure the TLS version
          • Migrate ECE on Podman hosts to SELinux enforce
        • Elastic Cloud on Kubernetes
      • Secure your cluster, deployment, or project
        • Self-managed security setup
          • Automatic security setup
          • Minimal security setup
          • Set up transport TLS
          • Set up HTTPS
          • Configure security in Kibana
        • Manage TLS encryption
          • Self-managed
            • Update TLS certificates
              • With the same CA
              • With a different CA
            • Mutual authentication
            • Supported SSL/TLS versions by JDK version
            • Enabling cipher suites for stronger encryption
          • ECK
            • Manage HTTP certificates on ECK
            • Manage transport certificates on ECK
            • Elasticsearch client certificate authentication
            • Fleet Server client certificate authentication
          • External CA for TLS
        • Network security
          • How network security policies work in Cloud
          • How IP filtering rules work in ECE
          • Add IP filters
            • In ECH or Serverless
            • In ECE
            • In ECK and Self Managed
          • Remote cluster filters
          • Private connectivity
            • AWS PrivateLink
            • Azure Private Link
            • GCP Private Service Connect
            • Claim private connection ownership
          • Through the API
          • Kubernetes network policies
        • Elastic Cloud Static IPs
        • Kibana session management
        • Encrypt your deployment data
          • Use a customer-managed encryption key
        • Secure your settings
          • Secure settings on ECK
        • Secure Kibana saved objects
        • Security event audit logging
          • Enable audit logging
          • Configure audit logging
            • Elasticsearch audit events ignore policies
            • Elasticsearch logfile output
          • Audit Elasticsearch search queries
          • Correlate audit events
      • Secure other Elastic Stack components
      • Securing HTTP client applications
      • Limitations
      • FIPS compliance
        • FIPS compliance for Elasticsearch
        • FIPS compliance for Kibana
        • FIPS mode for Ingest tools
    • Users and roles
      • Cloud organization
        • Manage users
        • User roles and privileges
        • Configure SAML SSO
          • Okta
          • Microsoft Entra ID
      • ECE orchestrator
        • Manage system passwords
        • Manage users and roles
          • Native users
          • Active Directory
          • LDAP
          • SAML
        • Configure SSO for deployments
      • Serverless project custom roles
      • Cluster or deployment
        • Quickstart
        • User authentication
          • Authentication realms
            • Realm chains
            • Security domains
          • Internal authentication
            • Native
            • File-based
          • External authentication
            • Active Directory
            • JWT
            • Kerberos
            • LDAP
            • OpenID Connect
              • With Azure, Google, or Okta
            • SAML
              • With Microsoft Entra ID
            • PKI
            • Custom realms
          • Built-in users
            • Change passwords
          • Orchestrator-managed users
            • ECH and ECE
            • ECK managed credentials
          • Kibana authentication
          • Kibana access agreement
          • Anonymous access
          • Token-based authentication services
          • Service accounts
          • Internal users
          • Operator privileges
            • Configure operator privileges
            • Operator-only functionality
            • Operator privileges for snapshot and restore
          • User profiles
          • Looking up users without authentication
          • Controlling the user cache
          • Manage authentication for multiple clusters
        • User roles
          • Built-in roles
          • Defining roles
            • Role structure
            • For data streams and aliases
            • Using Kibana
            • Role restriction
          • Elasticsearch privileges
          • Kibana privileges
          • Map users and groups to roles
            • Role mapping properties
          • Authorization delegation
          • Authorization plugins
          • Control access at the document and field level
          • Submit requests on behalf of other users
    • Spaces
      • Using Spaces with Fleet
    • API keys
      • Elasticsearch API keys
      • Serverless project API keys
      • Elastic Cloud API keys
      • Elastic Cloud Enterprise API keys
    • Application connections
      • OAuth for MCP clients
        • Create an OAuth client
        • Connect an MCP host
        • Revoke an OAuth client or connection
      • Manage application connections
    • Connectors
    • Remote clusters
      • Security models
      • Connection modes
      • On Elastic Cloud Hosted
        • To the same Elastic Cloud organization
        • To a different Elastic Cloud organization
        • To Elastic Cloud Enterprise
        • To a self-managed cluster
        • To Elastic Cloud on Kubernetes
        • Strong identity verification
        • Manage trusted environments
        • Migrate from the CCS deployment template
      • On Elastic Cloud Enterprise
        • To the same ECE environment
        • To a different ECE environment
        • To Elastic Cloud
        • To a self-managed cluster
        • To Elastic Cloud on Kubernetes
        • Manage trusted environments
        • Migrate from the CCS deployment template
      • On self-managed Elastic Stack
        • Add remote clusters using API key authentication
        • Add remote clusters using TLS certificate authentication
        • To Elastic Cloud on Kubernetes
        • Migrate from certificate to API key authentication
      • On Elastic Cloud on Kubernetes
        • To the same ECK environment
        • To a different ECK environment
        • To an external cluster or deployment
    • Cross-project search
      • Link and manage projects
      • Access and scope
    • Monitoring
      • AutoOps
        • For Elastic Cloud Hosted
        • For Elastic Cloud Serverless
          • Access AutoOps in your project
          • Search Tier view
          • Indexing Tier view
          • Search AI Lake view
        • For ECE, ECK, and self-managed clusters
          • Connect your cluster
          • Metrics storage locations
          • Connect your local development cluster
          • Configure Elastic agent with custom certificate
          • Disable certain types of data collection
          • Manage connected cluster users
          • Troubleshooting
            • Run the Connectivity Check
            • Firewalls blocking Elastic Agent
            • Connected clusters not appearing with ECK
        • Regions
        • Views
          • Overview
          • Deployment or Cluster
          • Nodes
          • Indices
          • Shards
          • Template Optimizer
        • Events
          • Event settings
          • Notification settings
        • FAQ
      • Stack monitoring
        • Enable on ECH and ECE
        • Enable on ECK
        • Self-managed: Elasticsearch
          • Collecting monitoring data with Elastic Agent
          • Collecting monitoring data with Metricbeat
          • Collecting log data with Filebeat
          • Monitoring in a production environment
          • Legacy collection methods
            • Collectors
            • Exporters
            • Local exporters
            • HTTP exporters
            • Pausing data collection
        • Self-managed: Kibana
          • Collect monitoring data with Elastic Agent
          • Collect monitoring data with Metricbeat
          • Legacy collection methods
        • Access monitoring data in Kibana
        • Visualizing monitoring data
          • Beats metrics
          • Elasticsearch metrics
          • Kibana metrics
          • Integrations Server metrics
          • Logstash metrics
          • Troubleshooting
        • Stack monitoring alerts
        • Configuring monitoring data streams and indices
          • Configuring data streams created by Elastic Agent
          • Configuring data streams created by Metricbeat 8
          • Configuring indices created by Metricbeat 7 or internal collection
      • AutoOps vs. Stack Monitoring
      • Cloud deployment health
        • Performance metrics on Elastic Cloud
        • JVM memory pressure indicator
      • Query activity
      • Kibana task manager monitoring
      • Monitoring orchestrators
        • ECK operator metrics
          • Enabling the metrics endpoint
          • Securing the metrics endpoint
          • Prometheus requirements
        • ECE platform monitoring
          • Platform monitoring deployment logs and metrics
          • Proxy log fields
          • Set the retention period for logging and metrics indices
      • Logging
        • Elasticsearch log4j configuration
        • Update Elasticsearch logging levels
        • Query logging in Elasticsearch
        • Elasticsearch deprecation logs
        • Slow query and index logging
        • Kibana logging
          • Set global log levels for Kibana
          • Advanced Kibana logging settings
            • Examples
    • Configure Kibana reporting
    • Customize Kibana branding
    • Manage your Cloud organization
      • Manage multiple organizations
      • Billing
        • Hosted billing dimensions
        • Serverless billing dimensions
          • Elasticsearch projects
          • Observability projects
          • Security projects
        • Billing models
        • Add your billing details
        • View your billing history
        • Manage budgets and notifications
        • Manage your subscription
        • Monitor and analyze usage
        • Elastic Consumption Units
        • Billing FAQ
      • Operational emails
      • Update billing and operational contacts
      • Service status
      • Tools and APIs
    • Licenses and subscriptions
      • Elastic Cloud Enterprise
      • Elastic Cloud on Kubernetes
      • Self-managed cluster
    • Maintenance
      • ECE maintenance
        • Deployments maintenance
          • Pause instance
        • Maintenance activities
          • Enable maintenance mode
          • Scale out your installation
          • Move nodes or instances from allocators
          • Perform ECE hosts maintenance
          • Delete ECE hosts
      • Start and stop services
        • Start and stop Elasticsearch
        • Start and stop Kibana
        • Restart an Elastic Cloud Hosted deployment
        • Restart an ECE deployment
        • Full Cluster restart and rolling restart procedures
      • Start and stop routing requests
      • Add and Remove Elasticsearch nodes
    • Upgrade
      • Plan your upgrade
      • Preparation steps
        • Upgrade Assistant
      • Upgrade your deployment or cluster
        • Upgrade from 7.17 to 9.5.1
        • Upgrade on Elastic Cloud Hosted
        • Upgrade on Elastic Cloud Enterprise
        • Upgrade on Elastic Cloud on Kubernetes
        • Upgrade Elastic on a self-managed cluster
          • Upgrade Elasticsearch
          • Upgrade Elasticsearch running on Docker
          • Upgrade Kibana
            • Saved object migrations
            • Roll back to a previous version
        • Archived settings
        • Reading indices from older versions
        • Upgrade Enterprise Search
      • Upgrade your ingest components
      • Upgrade your ECE or ECK orchestrator
        • Upgrade Elastic Cloud Enterprise
          • Re-running the ECE upgrade
        • Upgrade Elastic Cloud on Kubernetes
    • Uninstall
      • Uninstall Elastic Cloud Enterprise
      • Uninstall Elastic Cloud on Kubernetes
      • Delete an orchestrated deployment
  • Manage your Cloud account
    • Join or leave an organization
    • Update your email address
    • Change your password
    • Add a login method
    • Multifactor authentication
    • View and switch between organizations
    • Use dark mode in Kibana
    • Use high-contrast mode in Kibana
    • Change the interface language in Kibana
  • Extend and contribute
    • Contribute to Kibana
      • Getting started
        • Set up a Development Environment
        • Hello World
        • Add data
        • Running Elasticsearch during development
        • WSL on Windows Development
        • Local cross cluster search setup
        • Troubleshooting
      • Contributing
        • Principles
          • Security
          • Accessibility
          • Internationalization
          • Performance
          • Standards and guidelines
        • How we use Github
          • Submitting a pull request
          • Pull request review guidelines
          • Effective issue reporting in Kibana
          • Feature development
        • Repository structure
          • TypeScript project references
          • Linting
          • Documentation
          • Managing third-party dependencies
          • Upgrading Node.js
          • Logging
          • Saved objects and migrations
          • Runtime constraints
          • Package design
        • Guidelines for HTTP API design in Kibana
          • Guidelines for Terraform friendly HTTP APIs
        • CI
          • Building a Kibana distributable
          • Debugging in development
          • Debugging FIPS test failures
      • Key concepts
        • Platform architecture
          • Anatomy of a plugin
          • Patterns
          • Routing, Navigation and URL
        • Security overview
          • Kibana API authorization
          • Creating Feature Privileges
          • RBAC and the Saved Objects client
          • Security Kibana System User
          • Encrypted Saved Objects
          • Audit Logging
        • Saved Objects
          • Structure
          • Create a type
          • Update a type
          • Validate type changes
          • Troubleshooting validation
          • Delete a type
          • CRUD operations
          • ES|QL
          • Export and import
          • Share across spaces
          • Migrations
          • Legacy URL Aliases
          • Persistable State
        • Data Views
        • Building blocks
          • Embeddables
          • UI Actions
          • Visualization Framework (Lens)
            • Lens Config API
              • Lens Config Builder API - Metric
              • Lens Config Builder API - Gauge
              • Lens Config Builder API - Pie
              • Lens Config Builder API - Mosaic
              • Lens Config Builder API - TreeMap
              • Lens Config Builder API - Tag Cloud
              • Lens Config Builder API - Region Map
              • Lens Config Builder API - Table
              • Lens Config Builder API - Heatmap
              • Lens Config Builder API - XY Chart
        • Plugin performance and optimization
          • Client performance
          • Server performance
          • Case studies
            • Case Study - Async too early
            • Case Study - Top level imports
            • Case Study - Uncommon code in common
      • Tutorials
        • Access the Elasticsearch Client in a Plugin
        • Saved Object search method
        • Data views API
        • Kibana data.search Services
        • Registering and accessing an endpoint
        • Versioning HTTP APIs
        • Versioning interfaces
        • Generating OAS for HTTP APIs
        • Application service
        • Kibana Page Template
        • Chrome Recently Viewed
        • Kibana Expressions Service
        • Lens Config Builder API Examples
        • Add data tutorials
        • Configuration service
        • UI settings
        • Internationalization (i18n)
        • Logging service
        • Reporting integration
        • Development Telemetry
        • Screenshotting
        • External plugin development
          • Plugin tooling
          • Functional Tests for Plugins outside the Kibana repo
          • Testing Kibana Plugins
      • Testing
        • Unit tests
        • Integration tests
        • Test coverage checklist
        • API and E2E tests
          • Set up plugin
          • Run tests
          • Debugging
          • Logging
          • Best practices
          • Fixtures
          • Page objects
          • API services
          • Parallelism
          • Global setup and teardown
          • Deployment tags
          • Skip tests
          • Feature flags
          • UI testing
            • Write UI tests
            • Best practices
            • Browser auth
            • A11y checks
          • API testing
            • Write API tests
            • Best practices
            • API auth
          • Migrate tests
          • EUI test helpers
        • Functional Test Runner (legacy)
      • List of Kibana plugins
      • List of dependencies
    • Contribute to Logstash
      • How to write a Logstash input plugin
      • How to write a Logstash codec plugin
      • How to write a Logstash filter plugin
      • How to write a Logstash output plugin
      • Logstash Plugins Community Maintainer Guide
      • Document your plugin
      • Publish your plugin to RubyGems.org
      • List your plugin
      • Contributing a patch to a Logstash plugin
      • Extending Logstash core
      • Create Logstash plugins
        • How to write a Java input plugin
        • How to write a Java codec plugin
        • How to write a Java filter plugin
        • How to write a Java output plugin
    • Contribute to Beats
      • Pull request review guidelines
      • Contributing to the docs
      • Testing
      • Community Beats
        • Defining field mappings
        • Naming Conventions
        • Python in Beats
      • Creating New Kibana Dashboards
        • Importing Existing Beat Dashboards
        • Building Your Own Beat Dashboards
        • Generating the Beat Index Pattern
        • Exporting New and Modified Beat Dashboards
        • Archiving Your Beat Dashboards
        • Sharing Your Beat Dashboards
      • Adding a New Protocol to Packetbeat
        • Getting Ready
        • Protocol Modules
        • Testing
      • Extending Metricbeat
        • Overview
        • Creating a Metricset
        • Metricset Details
        • Creating a Metricbeat Module
        • Metricbeat Developer FAQ
      • Creating a New Filebeat Module
      • Migrating dashboards from Kibana 5.x to 6.x
    • Create Elasticsearch plugins
      • Creating text analysis plugins with the stable plugin API
        • The plugin descriptor file for stable plugins
        • Example text analysis plugin
      • Creating classic plugins
        • The plugin descriptor file for classic plugins
    • Create an Integration
      • What is an integration?
        • Definitions
      • OTel Input Packages
      • Quick start: Sample integration
      • Build an integration
        • Overview and prerequisites
        • Spin up the Elastic Stack
        • Create a new package
        • Add a data stream
        • Define deployment modes
        • Agent version conditions
        • Edit ingest pipelines
        • Edit field mappings
        • Create and export dashboards
        • Enable automatic installation for content packages
        • Build
        • Testing and validation
        • Finishing touches
        • Tips for building integrations
      • Upload an integration
      • Test an integration
        • Asset testing
        • Pipeline Testing Guide
        • Policy testing
        • Static testing
        • System Testing Guide
      • Publish an integration via Pull Request
      • Developer workflows
        • Development process for Fleet UI
        • Release a bug fix for supporting older package version
        • Import integration from Beats modules
      • Integrations guidelines
        • General guidelines
        • Dashboard guidelines
        • Documentation guidelines
        • TSDS guidelines
      • Working with indexing features
        • How to test indexing features
      • elastic-package reference
      • Package specification
        • _dev
        • data_stream
        • docs
        • kibana
        • changelog.yml
        • manifest.yml
  • Contribute to the docs
    • Contribute on the web
    • Contribute locally
    • Syntax quick reference
    • Content types
      • Changelogs
      • How-to guides
      • Overviews
      • Troubleshooting
      • Tutorials
    • How-to guides
      • Create good issues
      • Make your docs findable
      • Update Integrations docs
      • Write cumulative documentation
        • Guidelines
        • Badge usage and placement
        • Example scenarios
        • Quick reference
      • Document deployment types
        • Deployment types reference
        • Documentation strategies
    • Style guide
      • Voice and tone
      • Accessibility and inclusivity
      • Grammar and spelling
      • Word choice
      • Formatting
      • Writing about the UI
    • Tools
      • Elastic Docs Utilities
      • Vale style checker
    • Contribute to API docs
      • How API docs work
      • Checklist
      • Core guidelines
      • Organize and annotate docs
      • Quickstarts
        • Elasticsearch API docs
        • Kibana API docs
      • API docs by product
      • Report issues and get help
    • Contribute to Asciidoc docs
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2026 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.