👋 Thanks for checking out our Elastic Docs v3 POC. Have feedback? Reach out here. Thanks!

Elastic Elastic Elastic
  • Elastic Docs v3
    • Search Build custom applications with your data using Elasticsearch.
    • Observability Monitor applications and systems with Elastic Observability.
    • Security Detect, investigate, and respond to threats with Elastic Security.
    • Elastic Cloud Deploy instances of the Elastic Stack in the cloud, with the provider of your choice.
    • Elastic Cloud Enterprise Deploy Elastic Cloud on public or private clouds, virtual machines, or your own premises.
    • Elastic Cloud on Kubernetes Deploy Elastic Cloud on Kubernetes.
    • Self managed Install, configure, and run Elastic products on your own premises.
    • API Reference Description.
    • Configuration Reference Description.
    • Troubleshooting Description.
  • What's New
/

Elastic Docs Guide

  • Get started
    • The stack
    • Deployment options
    • Use cases
    • Contribute
  • Solutions and use cases
    • Observability
      • Get started
        • What is Elastic Observability
        • Create an Observability project
        • Quickstart: Monitor hosts with Elastic Agent
        • Quickstart: Monitor your Kubernetes cluster with Elastic Agent
        • Quickstart: Monitor hosts with OpenTelemetry
        • Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
        • Quickstart: Collect data with AWS Firehose
        • Add data from Splunk
        • Get started with dashboards
      • Applications and services
        • Application performance monitoring (APM)
          • Get started with APM
            • Fleet-managed APM Server
            • APM Server binary
          • Learn about application data types
            • Spans
            • Transactions
              • Transaction sampling
            • Traces
            • Errors
            • Metrics
            • Metadata
          • Collect application data
            • Elastic APM agents
              • Centrally configure APM agents in Kibana
              • Real User Monitoring (RUM)
              • Create and upload source maps (RUM)
            • Use OpenTelemetry with APM
              • Upstream OpenTelemetry Collectors and language SDKs
              • Collect metrics
              • Limitations
              • Resource Atrributes
            • Kubernetes
            • Monitoring AWS Lambda Functions
            • Jaeger (deprecated)
          • View and analyze data
            • Overviews
              • Services
              • Traces
              • Dependencies
              • Service map
              • Service overview
              • Mobile service overview
            • Inventory
            • Drill down into data
              • Transactions
              • Trace sample timeline
              • Errors
              • Metrics
              • Infrastructure
              • Logs
            • Filter and search application data
              • Filter application data
              • Use advanced queries on your application data
              • Cross-cluster search
            • Interpret application data
              • Find transaction latency and failure correlations
              • Track deployments with annotations
              • Explore mobile sessions with Discover
              • Observe Lambda functions
            • Integrate with machine learning
            • Identify deployment details for APM agents
            • Applications UI settings
          • Act on data
            • Create APM rules and alerts
            • Create custom links
          • Use APM securely
            • Secure data
              • Control access to APM data
              • Built-in data filters
              • Custom filters
              • Delete sensitive data
            • Secure communication with APM agents
              • APM agent TLS communication
              • API keys
              • Secret token
              • Anonymous authentication
            • Secure communication with the Elastic Stack
              • Use feature roles
              • Grant access using API keys
            • Secure access to the Applications UI
              • Create an APM reader user
              • Create an annotation user
              • Create an API user
              • Create a central config user
              • Create a storage explorer user
          • Manage storage
            • Storage Explorer
            • Data streams
            • Index lifecycle management
            • View the Elasticsearch index template
            • Parse data using ingest pipelines
            • Storage and sizing guide
            • Reduce storage
            • Explore data in Elasticsearch
          • Configure APM server
            • General configuration options
            • Anonymous authentication
            • APM agent authorization
            • APM agent central configuration
            • Instrumentation
            • {{kib}} endpoint
            • Logging
            • Output
              • {{ess}}
              • {{es}}
              • {{ls}}
              • Kafka
              • Redis
              • Console
            • Project paths
            • Real User Monitoring (RUM)
            • SSL/TLS settings
              • SSL/TLS output settings
              • SSL/TLS input settings
            • Tail-based sampling
            • Use environment variables in the configuration
            • Advanced setup
              • Installation layout
              • Secrets keystore
              • Command reference
              • Tune data ingestion
              • High Availability
              • APM Server and systemd
          • Monitor APM Server
            • Fleet-managed
            • APM Server binary
              • Use internal collection
              • Use {{metricbeat}} collection
              • Use local collection
          • APM APIs
            • APM UI API
              • Agent Configuration API
              • Annotation API
              • RUM source map API
              • APM agent Key API
              • Managed intake service event API
            • APM Server API
              • APM Server information API
              • Elastic APM events intake API
              • Elastic APM agent configuration API
              • OpenTelemetry intake API
              • Jaeger event intake
            • Common problems
            • What happens when APM Server or Elasticsearch is down?
            • APM Server response codes
            • Processing and performance
            • APM Server binary debugging
            • APM Server performance diagnostic
          • Upgrade
            • APM agent compatibility
            • Upgrade to version 8.x
              • Self-installation standalone
              • Self-installation APM integration
              • {{ecloud}} standalone
              • {{ecloud}} APM integration
            • Switch to the Elastic APM integration
              • Switch a self-installation
              • Switch an {{ecloud}} cluster
        • Synthetic monitoring
          • Get started
            • Create monitors with Project monitors
            • Create monitors in the Synthetics app
          • Scripting browser monitors
            • Write a synthetic test
            • Configure individual browser monitors
            • Use the Synthetics Recorder
          • Configure lightweight monitors
          • Manage monitors
          • Work with params and secrets
          • Analyze data from synthetic monitors
          • Monitor resources on private networks
          • Use the Synthetics CLI
          • Configure Synthetics projects
          • Multi-factor Authentication (MFA) for browser monitors
          • Configure Synthetics settings
          • Grant users access to secured resources
            • Setup role
            • Writer role
            • Reader role
          • Manage data retention
          • Use Synthetics with traffic filters
          • Migrate from the Elastic Synthetics integration
          • Scale and architect a Synthetics deployment
          • Synthetics support matrix
          • Synthetics Encryption and Security
        • Real user monitoring
        • Uptime monitoring (deprecated)
          • Get started
          • Analyze
            • View monitor status
            • Analyze monitors
            • Inspect uptime duration anomalies
          • Configure settings
        • Tutorial: Monitor a Java application
      • CI/CD
      • Cloud
        • AWS
          • Ingestion options
          • Monitor {{aws}} with {{agent}}
            • EC2
            • Kinesis data streams
            • S3
            • SQS
          • Monitor {{aws}} with {{beats}}
          • Monitor {{aws}} with Amazon Data Firehose
            • VPC Flow Logs
            • CloudTrail logs
            • Network Firewall logs
            • WAF logs
            • CloudWatch logs
          • Monitor {{aws}} with Elastic Serverless Forwarder
        • Azure
          • Monitor Microsoft Azure with Elastic Agent
          • Monitor Microsoft Azure with Beats
          • Monitor Microsoft Azure with the Azure Native ISV Service
          • Monitor Microsoft Azure OpenAI
        • GCP
          • GCP Dataflow templates
      • Infrastructure and hosts
        • Analyze infrastructure and host metrics
          • Get started with system metrics
          • View infrastructure metrics by resource type
          • Explore infrastructure metrics over time
          • Analyze and compare hosts
          • Detect metric anomalies
          • Configure settings
        • Universal Profiling
          • Get started
          • Manage data storage
            • Index lifecycle management
            • Configure probabilistic profiling
          • Advanced configuration
            • Tag data for querying
            • Add symbols for native frames
            • Use a proxy
            • Override kernel version check
            • Environment variables to configure the Universal Profiling Agent
            • Configuration file of the Universal Profiling Agent
          • Upgrade
          • Self-hosted infrastructure
          • Install the backend
            • Step 1: Update the stack
            • Step 2: Enable Universal Profiling in Kibana
            • Step 3: Set up Universal Profiling in Kibana
            • Step 4: Run the backend applications
            • Step 5: Next steps
          • Operate the backend
          • Universal Profiling issues
        • Tutorial: Observe your Kubernetes deployments
        • Tutorial: Observe your nginx instances
          • Understanding "no results found" message
      • Logs
        • Get started with system logs
        • Stream any log file
        • Stream application logs
          • Plaintext application logs
          • ECS formatted application logs
          • APM agent log sending
        • Parse and route logs
        • Filter and aggregate logs
        • Explore logs
          • Logs Explorer
          • Categorize log entries
          • Inspect log anomalies
          • Configure data sources
          • Logs Stream
        • Run a pattern analysis on log data
        • Add a service name to logs
      • Incident management
        • Alerting
          • Create and manage rules
            • Anomaly detection
            • Create an APM anomaly rule
            • Create a custom threshold rule
            • Elasticsearch query
            • Create an error count threshold rule
            • Create a failed transaction rate threshold rule
          • Create an inventory rule
            • Create a latency threshold rule
            • Log threshold
            • Metric threshold
            • Create a monitor status rule
            • TLS certificate
            • Uptime duration anomaly
            • Create an SLO burn rate rule
          • Aggregation options
            • Rate aggregation
          • View alerts
            • Triage SLO burn rate breaches
            • Triage threshold breaches
          • Cases
            • Configure access to cases
            • Create and manage cases
            • Configure case settings
          • Service-level objectives (SLOs)
            • Configure SLO access
            • Create an SLO
      • Data set quality monitoring
      • Observability AI Assistant
      • Tools and APIs
      • Unknown Bucket
        • View monitor status
        • Monitor {{aws}} with Amazon Data Firehose
        • Serverless observability limitations
        • Host metrics
        • Container metrics
        • Kubernetes pod metrics
        • AWS metrics
        • Logs index template reference
    • Security
      • Elastic Security
      • Get started
        • Elastic Security requirements
        • Create a Security project
        • Elastic Security UI
        • Ingest data to Elastic Security
          • Enable threat intelligence integrations
          • Automatic import
          • Agentless integrations
        • Spaces and Elastic Security
        • Data views and Elastic Security
        • Create runtime fields in Elastic Security
        • Configure advanced settings
      • AI for security
        • AI Assistant
          • AI Assistant Knowledge Base
        • Attack Discovery
        • Set up connectors for large language models (LLM)
          • Large language model performance matrix
          • Connect to Azure OpenAI
          • Connect to Amazon Bedrock
          • Connect to OpenAI
          • Connect to Google Vertex
          • Connect to your own local LLM
        • Use cases
          • Triage alerts
          • Identify, investigate, and document threats
          • Generate, customize, and learn about ES|QL queries
      • Detections and alerts
        • Detections requirements
        • Using logsdb index mode with Elastic Security
        • About detection rules
        • Create a detection rule
          • Cross-cluster search and detection rules
          • Launch Timeline from investigation guides
          • Exclude cold and frozen data from individual rules
        • Install and manage Elastic prebuilt rules
        • Manage detection rules
        • Monitor rule executions
        • Rule exceptions
          • Create and manage value lists
          • Add and manage exceptions
          • Create and manage shared exception lists
        • About building block rules
        • MITRE ATT&CK® coverage
        • Manage detection alerts
          • Visualize detection alerts
          • View detection alert details
          • Add detection alerts to cases
          • Suppress detection alerts
        • Reduce notifications and alerts
        • Query alert indices
        • Tune detection rules
      • Configure endpoint protection with Elastic Defend
        • Elastic Defend requirements
        • Install Elastic Defend
          • Enable access for macOS Monterey
          • Enable access for macOS Ventura and higher
          • Deploy on macOS with MDM
          • Prevent Elastic Agent uninstallation
        • Elastic Defend feature privileges
        • Configure an integration policy for Elastic Defend
          • Configure updates for protection artifacts
          • Turn off diagnostic data for Elastic Defend
          • Configure self-healing rollback for Windows endpoints
          • Configure Linux file system monitoring
          • Configure data volume for Elastic Endpoint
          • Create an Elastic Defend policy using API
        • Configure offline endpoints and air-gapped environments
        • Uninstall Elastic Agent
      • Manage Elastic Defend
        • Endpoints
        • Policies
        • Trusted applications
        • Event filters
        • Host isolation exceptions
        • Blocklist
        • Optimize Elastic Defend
        • Event capture and Elastic Defend
        • Endpoint protection rules
        • Identify antivirus software on your hosts
        • Allowlist Elastic Endpoint in third-party antivirus apps
        • Elastic Endpoint self-protection features
      • Endpoint response actions
        • Automated response actions
        • Isolate a host
        • Response actions history
        • Third-party response actions
        • Configure third-party response actions
      • Cloud Security
        • Security posture management overview
        • Enable cloud security features
        • Cloud security posture management
          • Get started with CSPM for AWS
          • Get started with CSPM for GCP
          • Get started with CSPM for Azure
          • CSPM privilege requirements
          • Findings page
          • Benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Kubernetes security posture management
          • Get started with KSPM
          • Findings page
          • Benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Cloud native vulnerability management
          • Get started with CNVM
          • Findings page
          • Cloud Native Vulnerability Management Dashboard
          • Frequently asked questions (FAQ)
        • Cloud workload protection for Kubernetes
          • Get started with CWP for Kubernetes
          • Container workload protection policies
          • Kubernetes dashboard
        • Cloud workload protection for VMs
          • Capture environment variables
        • Ingest third-party cloud security data
          • Ingest CNCF Falco data
          • Ingest AWS Security Hub data
          • Ingest Wiz data
      • Investigation tools
        • Timeline
          • Timeline templates
        • Visual event analyzer
        • Session view
        • Osquery
          • Manage the integration
          • Osquery FAQ
          • Add Osquery Response Actions
          • Run Osquery from investigation guides
          • Run Osquery from alerts
          • Examine Osquery results
          • Use placeholder fields in Osquery queries
        • Notes
        • Indicators of compromise
        • Cases
          • Cases requirements
          • Open and manage cases
          • Configure case settings
      • Dashboards
        • Overview dashboard
        • Detection & Response dashboard
        • Kubernetes dashboard
        • Cloud Security Posture dashboard
        • Entity Analytics dashboard
        • Data Quality dashboard
        • Cloud Native Vulnerability Management Dashboard
        • Detection rule monitoring dashboard
      • Explore
        • Hosts page
        • Network page
          • Configure network map data
        • Users page
      • Advanced Entity Analytics
        • Entity risk scoring
          • Entity risk scoring requirements
          • Turn on the risk scoring engine
          • Asset criticality
          • Entity store
          • View and analyze risk score data
        • Advanced behavioral detections
          • Machine learning job and rule requirements
          • Anomaly detection
          • Optimizing anomaly results
          • Behavioral detection use cases
      • Asset management
      • APIs and tools
    • Search
      • Get started
      • Search approaches
        • Long-running searches
        • Near real-time search
      • Query languages for search
      • Inference API
        • Elastic Inference Service (EIS)
        • AlibabaCloud AI Search inference integration
        • Amazon Bedrock inference integration
        • Anthropic inference integration
        • Azure AI studio inference integration
        • Azure OpenAI inference integration
        • Chat completion inference API
        • Cohere inference integration
        • Elasticsearch inference integration
        • ELSER inference integration
        • Google AI Studio inference integration
        • Google Vertex AI inference integration
        • HuggingFace inference integration
        • JinaAI inference integration
        • Mistral inference integration
        • OpenAI inference integration
        • Watsonx inference integration
      • Building search in your app or site
      • Search templates
      • Ingest for search
      • Full-text search
        • Search with synonyms
        • Text analysis during search
      • Vector search
        • Dense vector
          • KNN
        • Semantic search with ELSER
      • Hybrid search with semantic_text
      • Semantic search
        • Semantic search with semantic_text
        • Hybrid search with semantic_text
        • Semantic search with the {{infer}} API
        • Semantic search with ELSER
        • Using Cohere with {{es}}
        • Semantic search with deployed model
        • Bring your own dense vectors
      • Ranking and reranking
        • Semantic reranking
        • Learning To Rank (LTR)
          • Deploy and manage LTR models
          • Search using LTR
      • RAG
        • Playground
          • Optimize model context
          • View and modify queries
          • Troubleshooting
      • Auto-complete
      • Spelling correction
      • Cross-cluster search
        • Advantages of using this endpoint before a {{ccs}}
      • Integrating search into your site or app
        • Clients
        • What is Search UI?
        • Behavioral analytics
          • Get started
          • Set up CORs
          • View events
          • Events reference
          • API overview
      • Search Applications
        • Search API and templates
        • Security
        • Search Application client guide
      • Examples
        • Mixing exact search with stemming
        • Getting consistent scoring
        • Incorporating static relevance signals into the score
      • APIs and tools
    • Other use cases
  • Manage data
    • The Elasticsearch data store
      • Index basics
      • Index types
        • Data streams
          • Set up a data stream
          • Use a data stream
          • Modify a data stream
          • Time series data stream (TSDS)
            • Set up a TSDS
            • Downsampling a time series data stream
            • Run downsampling with ILM
            • Run downsampling manually
            • Run downsampling using data stream lifecycle
            • Reindex a TSDS
          • Logs data stream
        • logsdb
        • tsdb
        • vectordb
      • Mapping
        • Dynamic mapping
          • Dynamic field mapping
          • Dynamic templates
        • Explicit mapping
        • Runtime fields
          • Map a runtime field
          • Define runtime fields in a search request
          • Override field values at query time
          • Retrieve a runtime field
          • Index a runtime field
          • Explore your data with runtime fields
        • Removal of mapping types
      • Text analysis
        • Concepts
          • Anatomy of an analyzer
          • Index and search analysis
          • Stemming
          • Token graphs
        • Configure text analysis
          • Test an analyzer
          • Configuring built-in analyzers
          • Create a custom analyzer
          • Specify an analyzer
      • Templates
        • Simulate multi-component templates
        • Config ignore_missing_component_templates
        • Index management in the UI
      • Aliases
      • Manage data from the command line
    • Ingestion
      • Ingesting timeseries data
      • Ingesting data for Elastic solutions
      • Ingesting data from applications
        • Ingest data with Node.js on Elasticsearch Service
        • Ingest data with Python on Elasticsearch Service
        • Ingest data from Beats to Elasticsearch Service with Logstash as a proxy
        • Ingest data from a relational database into Elasticsearch Service
        • Ingest logs from a Python application using Filebeat
        • Ingest logs from a Node.js web application using Filebeat
      • Ingest reference architectures
        • Ingest architectures
        • Elastic Agent to Elasticsearch
          • Elastic Agent to Elasticsearch: Agent installed
          • Elastic Agent to Elasticsearch: APIs for collection
        • Elastic Agent to Logstash to Elasticsearch
          • Elastic Agent to Logstash (for enrichment) to Elasticsearch
          • Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering
          • Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy
          • Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations
        • Elastic Agent to proxy to Elasticsearch
        • Elastic Agent to Elasticsearch with Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Logstash to Elasticsearch: Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Kafka ES Sink to Elasticsearch: Kafka as middleware message queue
        • Logstash to Elasticsearch
        • Elastic air-gapped architectures
          • Elastic Agent to Elasticsearch: Air-gapped environment
          • Elastic Agent to Logstash: Air-gapped environment
      • Sample data
      • Transform and enrich data
        • Ingest pipelines
          • Example
        • Logstash pipelines
        • Data enrichment
          • Set up an enrich processor
          • Example: Enrich your data based on geolocation
          • Example: Enrich your data based on exact values
          • Example: Enrich your data by matching a value to a range
        • Index mapping and text analysis
      • Ingest tools overview
        • Upload data files
    • Data lifecycle
      • Data tiers
      • Index lifecycle management
        • Tutorial
        • Tutorial
        • Index management in Kibana
        • Concepts
          • Index lifecycle
          • Rollover
          • Policy updates
        • Configure a lifecycle policy
        • Migrate index allocation filters to node roles
        • Start and stop index lifecycle management
        • Manage existing indices
        • Skip rollover
        • Restore a managed data stream or index
      • Data stream lifecycle
        • Tutorial: Create a data stream with a lifecycle
        • Tutorial: Update existing data stream
        • Tutorial: Data stream retention
        • Tutorial: Migrate ILM managed data stream to data stream lifecycle
      • Rollup
        • Getting started
        • Understanding groups
        • Rollup aggregation limitations
        • Rollup search limitations
        • Migrating to downsampling
      • Curator
    • Migrate data between Elasticsearch clusters
      • Migrate from a self-managed cluster with a self-signed certificate using remote reindex
      • Migrate internal indices
    • Use case: use Elasticsearch to manage time series data
  • Explore and analyze
    • Kibana quickstart
      • Accessibility
    • Querying and filtering
      • Query languages
        • QueryDSL
        • ES|QL
          • REST API
          • Using {{esql}} in {{kib}}
          • Using {{esql}} in {{elastic-sec}}
          • Using {{esql}} to query multiple indices
          • Using {{esql}} across clusters
          • Task management
        • SQL
          • Overview
          • Getting Started with SQL
          • Conventions and Terminology
            • Mapping concepts across SQL and Elasticsearch
          • Security
          • SQL REST API
            • Overview
            • Response Data Formats
            • Paginating through a large response
            • Filtering using Elasticsearch Query DSL
            • Columnar results
            • Passing parameters to a query
            • Use runtime fields
            • Run an async SQL search
          • SQL Translate API
          • SQL CLI
          • SQL JDBC
            • API usage
          • SQL ODBC
            • Driver installation
            • Configuration
          • SQL Client Applications
            • DBeaver
            • DbVisualizer
            • Microsoft Excel
            • Microsoft Power BI Desktop
            • Microsoft PowerShell
            • MicroStrategy Desktop
            • Qlik Sense Desktop
            • SQuirreL SQL
            • SQL Workbench/J
            • Tableau Desktop
            • Tableau Server
          • SQL Language
            • Lexical Structure
            • SQL Commands
            • DESCRIBE TABLE
            • SELECT
            • SHOW CATALOGS
            • SHOW COLUMNS
            • SHOW FUNCTIONS
            • SHOW TABLES
            • Data Types
            • Index patterns
            • Frozen Indices
          • Functions and Operators
            • Comparison Operators
            • Logical Operators
            • Math Operators
            • Cast Operators
            • LIKE and RLIKE Operators
            • Aggregate Functions
            • Grouping Functions
            • Date/Time and Interval Functions and Operators
            • Full-Text Search Functions
            • Mathematical Functions
            • String Functions
            • Type Conversion Functions
            • Geo Functions
            • Conditional Functions And Expressions
            • System Functions
          • Reserved keywords
          • SQL Limitations
        • EQL
          • Example: Detect threats with EQL
        • KQL
        • Lucene query syntax
      • Query tools
        • Saved queries
        • Console
        • Search profiler
        • Grok debugger
        • Playground
      • Filtering in Kibana
    • Scripting
      • Painless scripting language
      • How to write scripts
        • Scripts, caching, and search speed
        • Dissecting data
        • Grokking grok
      • Access fields in a document
      • Common scripting use cases
        • Field extraction
      • Accessing document fields and special variables
      • Scripting and security
      • Lucene expressions language
      • Advanced scripts using script engines
      • Painless lab
    • Aggregations
      • Basics
    • Geospatial analysis
    • Transforms
      • Overview
      • Setup
      • When to use transforms
      • Generating alerts for transforms
      • {{transforms-cap}} at scale
      • How checkpoints work
      • API quick reference
      • Tutorial: Transforming the eCommerce sample data
      • Examples
      • Painless examples
      • Limitations
    • Machine learning
      • Setup and security
      • Machine learning in Kibana
        • Anomaly detection
        • Data frame analytics
        • AIOps Labs
      • Anomaly detection
        • Finding anomalies
          • Plan your analysis
          • Run a job
          • View the results
          • Forecast future behavior
        • Tutorial
        • Advanced concepts
          • Anomaly detection algorithms
          • Anomaly score explanation
          • Job types
          • Working with anomaly detection at scale
          • Handling delayed data
        • API quick reference
        • How-tos
          • Generating alerts for anomaly detection jobs
          • Aggregating data for faster performance
          • Altering data in your datafeed with runtime fields
          • Customizing detectors with custom rules
          • Detecting anomalous categories of data
          • Reverting to a model snapshot
          • Detecting anomalous locations in geographic data
          • Mapping anomalies by location
          • Adding custom URLs to machine learning results
          • {{anomaly-jobs-cap}} from visualizations
          • Exporting and importing {{ml}} jobs
        • Resources
          • Limitations
          • Function reference
          • Supplied configurations
          • Troubleshooting and FAQ
      • Data frame analytics
        • Overview
        • Finding outliers
        • Predicting numerical values with regression
        • Predicting classes with classification
        • Advanced concepts
          • How {{dfanalytics-jobs}} work
          • Working with data frame analytics at scale
          • Adding custom URLs to data frame analytics jobs
          • Feature encoding
          • Feature processors
          • Feature importance
          • Loss functions for regression analyses
          • Hyperparameter optimization
          • Trained models
        • API quick reference
        • Resources
          • Limitations
      • NLP
        • Overview
          • Extract information
          • Classify text
          • Search and compare text
        • Deploy trained models
          • Select a trained model
          • Import the trained model and vocabulary
          • Deploy the model in your cluster
          • Try it out
        • Trained model autoscaling
        • Add NLP inference to ingest pipelines
        • API quick reference
        • Built-in NLP models
          • ELSER
          • Elastic Rerank
          • E5
          • Language identification
        • Compatible third party models
        • Examples
          • Named entity recognition
          • Text embedding and semantic search
        • Limitations
        • Inference processing
          • NLP tutorial
      • AIOps Labs
        • Detect anomalies
          • Tune your anomaly detection job
          • Forecast future behavior
        • Analyze log spikes and drops
        • Detect change points
    • AI assistant
    • Discover
      • Explore fields and data with Discover
      • Customize the Discover view
      • Search for relevance
      • Save a search for reuse
      • View field statistics
      • Run a pattern analysis on your log data
      • Run a search session in the background
      • Using ES|QL
    • Dashboards
      • Using
      • Building
        • Create a dashboard
        • Edit a dashboard
        • Add filter controls
        • Add drilldowns
        • Organize dashboard panels
        • Duplicate dashboards
        • Import dashboards
      • Managing
      • Sharing
      • Tutorials
        • Create a simple dashboard to monitor website logs
        • Create a dashboard with time series charts
    • Panels and visualizations
      • Supported chart types
      • Manage panels
      • Visualize Library
      • Lens
      • ES|QL
      • Field statistics
      • Custom visualizations with Vega
      • Text panels
      • Image panels
      • Link panels
      • Canvas
        • Edit workpads
        • Present your workpad
        • Tutorial: Create a workpad for monitoring sales
        • Canvas function reference
          • TinyMath functions
      • Maps
        • Build a map to compare metrics by country or region
        • Track, visualize, and alert on assets in real time
        • Map custom regions with reverse geocoding
        • Heat map layer
        • Tile layer
        • Vector layer
          • Vector styling
          • Vector style properties
          • Vector tooltips
        • Plot big data
          • Clusters
          • Display the most relevant documents per entity
          • Point to point
          • Term join
        • Search geographic data
          • Create filters from a map
          • Filter a single layer
          • Search across multiple indices
        • Configure map settings
        • Connect to Elastic Maps Service
        • Import geospatial data
          • Clean your data
          • Tutorial: Index GeoJSON data
        • Troubleshoot
      • Graph
        • Configure Graph
        • Troubleshooting and limitations
      • Legacy editors
    • Find and organize content
      • Data views
      • Saved objects
      • Files
      • Reports
      • Tags
      • What is Kibana?
    • Reporting and sharing
      • Automatically generate reports
      • Troubleshooting
        • CSV
        • PDF/PNG
    • Alerts and cases
      • Kibana alerts
        • Set up
        • Create and manage rules
        • View alerts
        • Rule types
          • Index threshold
          • {{es}} query
          • Tracking containment
        • Rule action variables
        • Troubleshooting and limitations
          • Common Issues
          • Event log index
          • Test connectors
        • Maintenance windows
      • Watcher
        • Getting started with Watcher
        • How Watcher works
        • Encrypting sensitive data in Watcher
        • Inputs
          • Simple input
          • Search input
          • HTTP input
          • Chain input
        • Triggers
          • Schedule trigger
        • Conditions
          • Always condition
          • Never condition
          • Compare condition
          • Array compare condition
          • Script condition
        • Actions
          • Running an action for each element in an array
          • Adding conditions to actions
          • Email action
          • Webhook action
          • Index action
          • Logging action
          • Slack action
          • PagerDuty action
          • Jira action
        • Transforms
          • Search {{watcher-transform}}
          • Script {{watcher-transform}}
          • Chain {{watcher-transform}}
        • Managing watches
        • Example watches
          • Watching the status of an Elasticsearch cluster
        • Limitations
      • Cases
        • Configure access to cases
        • Open and manage cases
        • Configure case settings
    • Numeral formatting
  • Deploy and manage
    • Distributed architecture
      • Clusters, nodes, and shards
        • Node roles
      • Reading and writing documents
      • Shard allocation, relocation, and recovery
        • Shard allocation awareness
        • Index-level shard allocation
          • Delaying allocation when a node leaves
      • Discovery and cluster formation
        • Discovery
        • Quorum-based decision making
        • Voting configurations
        • Bootstrapping a cluster
        • Cluster state
        • Cluster fault detection
      • Kibana tasks management
    • Deploy
      • Elastic Cloud
        • Create an organization
          • Subscribe from a marketplace
            • AWS Marketplace
              • Create a monthly pay-as-you-go subscription on AWS Marketplace
            • Azure Native ISV Service
              • Azure Marketplace pricing
            • Google Cloud Platform Marketplace
              • Create a monthly pay-as-you-go subscription on GCP Marketplace
            • Heroku
              • Introducing Elasticsearch Add-On for Heroku
                • Install the add-on
                  • Install a specific version and plugins
                  • Remove the add-on
                • Migrate between plans
                • Access the console
                  • Access Kibana
                • Manage data from the command line
                • Access the Elasticsearch API console
                • Next steps
                • Migrate your Elasticsearch data
                  • Migrate internal indices
              • About
                • Subscription levels
                • Version policy
                • Elasticsearch Add-On for Heroku hardware
                  • Elasticsearch Add-On for Heroku GCP instance configurations
                  • Elasticsearch Add-On for Heroku GCP default provider instance configurations
                  • Elasticsearch Add-On for Heroku AWS instance configurations
                  • Elasticsearch Add-On for Heroku AWS default provider instance configurations
                  • Elasticsearch Add-On for Heroku Azure instance configurations
                  • Elasticsearch Add-On for Heroku Azure default provider instance configurations
                • Elasticsearch Add-On for Heroku regions
                • Service status
                  • Subscribe to Individual Regions/Components
                  • Service Status API
                • Getting help
                • Restrictions and known problems
                • What���s new with the Elastic Stack
        • Serverless
          • Serverless differences
          • Create a serverless project
          • Regions
          • Project settings
        • Cloud Hosted
          • Create an Elastic Cloud Hosted deployment
            • Available stack versions
          • Access Kibana
          • Manage deployments
            • Configure
              • Change your configuration
                • What deployment settings are available?
                • Change hardware profiles
                • How can I customize the components of my deployment?
              • Configure your deployment
                • What deployment settings are available?
                • How can I customize the components of my deployment?
              • Edit stack settings
              • Add plugins and extensions
                • Add plugins provided with Elastic Cloud Hosted
                • Upload custom plugins and bundles
                • Manage plugins and extensions through the API
              • Custom endpoint aliases
            • Manage your Integrations server
              • Switch from APM to Integrations Server payload
            • Find your Cloud ID
          • Change hardware
          • Manage deployments using the Elastic Cloud API
          • Keep track of deployment activity
        • Tools and APIs
        • Restrictions and known problems
      • Elastic Cloud Enterprise
        • Service-oriented architecture
        • Services as Docker containers
        • Prepare your environment
          • Hardware prerequisites
          • Software prerequisites
          • System configuration
          • Networking prerequisites
          • High availability
          • Separation of roles
          • Load balancers
          • Users and permissions prerequisites
          • JVM heap size
          • Wildcard DNS record
          • Manage your installation capacity
        • Deploy an orchestrator
          • Install
            • Identify the deployment scenario
            • Install ECE on a Public Cloud
              • Configure your operating system cloud
                • Configure host Ubuntu cloud
                • Configure host RHEL cloud
                • Configure host SUSE cloud
              • Install ECE cloud
                • Deploy a small installation cloud
                • Deploy a medium installation cloud
                • Deploy a large installation cloud
                • Fresh installation of ECE using Podman hosts cloud
            • Install ECE on your own premises
              • Configure your operating system onprem
                • Configure host Ubuntu onprem
                • Configure host RHEL onprem
                • Configure host SUSE onprem
              • Install ECE onprem
                • Deploy a small installation onprem
                • Deploy a medium installation onprem
                • Deploy a large installation onprem
                • Fresh installation of ECE using Podman hosts onprem
            • Alternative: Install ECE with Ansible
            • Log into the Cloud UI
            • Install ECE on additional hosts
              • Generate roles tokens
            • Migrate ECE to Podman hosts
            • Post-installation steps
            • Statistics collected by Elastic Cloud Enterprise
          • Air gapped install
            • With your private Docker registry
            • Without a private Docker registry
            • Available Docker images
          • Configure
            • Assign roles to hosts
            • System deployments configuration
              • Default system deployment versions
            • Configure deployment templates
              • Tag your allocators
              • Edit instance configurations
              • Create instance configurations
              • Create deployment templates
              • Configure system deployment templates
              • Configure index management for templates
              • Updating custom templates to support node_roles and autoscaling
              • Updating custom templates to support Integrations Server
              • Default instance configurations
              • Include additional Kibana plugins
            • Change the ECE API URL
            • Change endpoint URLs
            • Enable custom endpoint aliases
              • Custom endpoint aliases
            • Configure allocator affinity
            • Change allocator disconnect timeout
            • Manage Elastic Stack versions
            • Migrate ECE on Podman hosts to SELinux enforce
        • Working with deployments
          • Deployment templates
          • Create a deployment
          • Edit stack settings
          • Customize your deployment
          • Resize deployment
            • Resource overrides
          • Manage your integrations server
            • Switch from APM to Integrations Server payload
          • Find your Cloud ID
          • Find your endpoint URL
          • Advanced cluster configuration
          • Search and filter deployments
          • Keep track of deployment activity
        • Tools and APIs
      • Elastic Cloud on Kubernetes
        • Deploy an orchestrator
          • Install
            • Install using YAML manifest (quickstart)
            • Install using a Helm chart
            • Deploy ECK on Openshift
              • Deploy the operator
              • Deploy an Elasticsearch instance with a route
              • Deploy a Kibana instance with a route
              • Deploy Docker images with anyuid SCC
              • Grant privileged permissions to Beats
              • Grant host access permission to Elastic Agent
            • Deploy ECK on GKE Autopilot
              • Ensuring virtual memory kernel settings
              • Installing the ECK Operator
              • Deploy an Elasticsearch instance
              • Deploy a standalone Elastic Agent and/or Beats
            • Deploy a FIPS compatible version of ECK
          • Air gapped install
          • Configure
            • Configure ECK
            • Required RBAC permissions
            • Configure the validating webhook
            • Restrict cross-namespace resource associations
            • Create custom images
            • Service meshes
              • Istio
              • Linkerd
            • Network policies
              • Prerequisites
            • Webhook namespace selectors
        • Manage deployments
          • Elasticsearch deployment quickstart
          • Kibana instance quickstart
          • Managing deployments using a Helm chart
          • Update your deployments
          • Accessing services
          • Configure deployments
            • Elasticsearch configuration
              • Node configuration
              • Volume claim templates
              • Storage recommendations
              • Transport settings
              • Virtual memory
              • Settings managed by ECK
              • Custom configuration files and plugins
              • Init containers for plugin downloads
              • Update strategy
              • Pod disruption budget
              • Nodes orchestration
              • Advanced Elasticsearch node scheduling
              • Readiness probe
              • Pod PreStop hook
              • Security context
            • Kibana configuration
              • Connect to an Elasticsearch cluster
              • Advanced configuration
              • Secure settings
              • HTTP configuration
              • Install Kibana plugins
            • TLS Certificates
            • Recipes
            • Requests routing to Elasticsearch nodes
            • Customize pods
            • Manage compute resources
            • Elastic Stack configuration policies
            • Connect to external Elastic resources
        • Orchestrate other Elastic applications
          • APM server
            • Use an Elasticsearch cluster managed by ECK
            • Advanced configuration
            • Connect to the APM Server
          • Standalone Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
          • Fleet-managed Elastic Agent
            • Quickstart
            • Configuration
            • Configuration Examples
            • Known limitations
          • Elastic Maps Server
            • Deploy Elastic Maps Server
            • Map data
            • Advanced configuration
            • HTTP configuration
          • Enterprise Search
            • Quickstart
            • Configuration
            • Troubleshooting
          • Beats
            • Quickstart
            • Configuration
            • Configuration Examples
            • Troubleshooting
          • Logstash
            • Quickstart
            • Configuration
            • Securing Logstash API
            • Logstash plugins
            • Configuration examples
            • Update Strategy
            • Advanced configuration
        • Tools and APIs
      • Self-managed cluster
        • Deploy the cluster
          • Important System configuration
            • Configuring system settings
            • Disable swapping
            • File Descriptors
            • Virtual memory
            • Number of threads
            • DNS cache settings
            • Ensure JNA temporary directory permits executables
            • TCP retransmission timeout
          • Installing Elasticsearch
            • Install Elasticsearch from archive on Linux or MacOS
            • Install Elasticsearch with .zip on Windows
            • Install Elasticsearch with Debian Package
            • Install Elasticsearch with RPM
            • Install Elasticsearch with Docker
          • Run {{es}} locally
          • Bootstrap Checks
            • Heap size check
            • File descriptor check
            • Memory lock check
            • Maximum number of threads check
            • Max file size check
            • Maximum size virtual memory check
            • Maximum map count check
            • Client JVM check
            • Use serial collector check
            • System call filter check
            • OnError and OnOutOfMemoryError checks
            • Early-access check
            • All permission check
            • Discovery configuration check
        • Configure Elasticsearch
          • Important settings configuration
          • Other configuration settings
          • Plugins
        • Install Kibana
          • Install from archive on Linux or macOS
          • Install on Windows
          • Install with Debian package
          • Install with RPM
          • Install with Docker
          • Configure
          • Access
        • Air gapped install
        • Tools and APIs
      • Kibana reporting configuration
    • Production guidance
      • Getting ready for production (Elasticsearch)
      • Production considerations
      • Plan for production (Elastic Cloud)
      • Availability and resilience
        • Resilience in small clusters
        • Resilience in larger clusters
      • Elasticsearch performance optimizations
        • Indexing speed
        • Search speed
        • Approximate kNN search
        • Disk usage
        • Size your shards
      • Kibana task manager scaling considerations
      • Alerting
      • General recommendations
    • Reference architectures
      • Hot/Frozen - High Availability
    • Backup, high availability, and resilience tools
      • Snapshot and restore
        • Manage snapshot repositories
          • Register a repository
            • Azure repository
            • Google Cloud Storage repository
            • S3 repository
            • Shared file system repository
            • Read-only URL repository
            • Source-only repository
          • Elastic Cloud Hosted
            • Snapshot and restore with custom repositories
              • Configure a snapshot repository using AWS S3
              • Configure a snapshot repository using GCS
              • Configure a snapshot repository using Azure Blob storage
            • Snapshot and restore with custom repositories
              • Configure a snapshot repository using AWS S3
              • Configure a snapshot repository using GCS
              • Configure a snapshot repository using Azure Blob storage
            • Access isolation for the found-snapshots repository
              • Repository isolation on Azure
              • Repository isolation on AWS and GCP
          • Elastic Cloud Enterprise
            • Google Cloud Storage (GCS) repository
            • Azure Storage repository
            • Minio on-premise repository
          • Elastic Cloud on Kubernetes
        • Create snapshots
        • Restore a snapshot
          • Restore a snapshot across clusters
            • Restore snapshot into a new deployment
            • Restore snapshot into an existing deployment
            • Restore snapshots containing searchable snapshots indices across clusters
        • Searchable snapshots
      • Cross-cluster replication
        • Set up {{ccr}}
          • Prerequisites
          • Connect to a remote cluster
          • Configure privileges for cross-cluster replication
          • Create a follower index to replicate a specific index
          • Create an auto-follow pattern to replicate time series indices
        • Manage cross-cluster replication
          • Inspect replication statistics
          • Pause and resume replication
          • Recreate a follower index
          • Terminate replication
        • Manage auto-follow patterns
          • Create auto-follow patterns
          • Retrieve auto-follow patterns
          • Pause and resume auto-follow patterns
          • Delete auto-follow patterns
        • Upgrading clusters
          • Uni-directional index following
          • Bi-directional index following
        • Uni-directional disaster recovery
          • Prerequisites
          • Failover when clusterA is down
          • Failback when clusterA comes back
        • Bi-directional disaster recovery
          • Initial setup
          • Failover when clusterA is down
          • Failback when clusterA comes back
          • Perform update or delete by query
    • Autoscaling
      • Deployment autoscaling
        • Autoscaling example
      • Deployment autoscaling
        • Autoscaling example
        • Autoscaling through the API
      • Deployment autoscaling
        • Autoscaling example
        • Autoscaling through the API
      • Autoscaling stateless applications on ECK
      • Deployments autoscaling on ECK
      • Autoscaling deciders
      • Trained model autoscaling
    • Remote clusters
      • Enable cross-cluster search and cross-cluster replication
        • Access other deployments of the same Elasticsearch Service organization
        • Access deployments of another Elasticsearch Service organization
        • Access deployments of an Elastic Cloud Enterprise environment
        • Access clusters of a self-managed environment
        • Enabling CCS/R between Elasticsearch Service and ECK
        • Edit or remove a trusted environment
        • Migrate the cross-cluster search deployment template
      • Enable cross-cluster search and cross-cluster replication
        • Access other deployments of the same Elastic Cloud Enterprise environment
        • Access deployments of another Elastic Cloud Enterprise environment
        • Access deployments of an Elasticsearch Service organization
        • Access clusters of a self-managed environment
        • Enabling CCS/R between Elastic Cloud Enterprise and ECK
        • Edit or remove a trusted environment
        • Migrate the cross-cluster search deployment template
      • Remote clusters (self-managed)
        • Add remote clusters using API key authentication
        • Add remote clusters using TLS certificate authentication
        • Migrate from certificate to API key authentication
        • Remote cluster settings
        • Troubleshooting
      • ECK remote clusters
    • Security
      • Secure your Elastic Cloud Enterprise installation
        • Manage security certificates
        • Allow x509 Certificates Signed with SHA-1
        • Configure the TLS version
      • Secure your cluster or deployment
        • Secure endpoints
          • Secure HTTP communications
          • Traffic filtering
            • IP traffic filtering
            • Private link traffic filters
              • AWS PrivateLink traffic filters
              • Azure Private Link traffic filters
              • GCP Private Service Connect traffic filters
              • Claim traffic filter link ID ownership through the API
            • Manage traffic filtering through the API
          • Elastic Cloud Static IPs
        • Kibana session management
        • Secure cluster communications
          • Security certificates and keys
            • Updating certificates
              • With the same CA
              • With a different CA
        • Secure clients and integrations
          • HTTP/REST clients and security
        • Encrypt your deployment
          • Encrypt your deployment with a customer-managed encryption key
        • Secure your settings
        • Secure saved objects
        • Manually configure security in a self-managed cluster
          • Set up minimal security
          • Set up basic security
          • Set up basic security plus HTTPS
        • Enabling cipher suites for stronger encryption
        • Supported SSL/TLS versions by JDK version
        • FIPS 140-2
    • Access
      • Elastic Cloud Enterprise orchestrator users
        • Manage system passwords
        • Manage users and roles
          • Native user authentication
          • Active Directory
          • LDAP
          • SAML
        • Configure SSO for deployments
      • Cloud organization users
        • Manage users
        • User roles
        • Configure {{ecloud}} SAML SSO
          • Register Elastic Cloud SAML in Okta
          • Register Elastic Cloud SAML in Microsoft Entra ID
      • Cluster or deployment auth
        • Quickstart
        • User authentication
          • Authentication realms
            • Realm chains
            • Security domains
          • Internal authentication
            • Native
            • File-based
          • External authentication
            • Active directory
            • JWT
            • Kerberos
            • LDAP
            • OpenID Connect
            • SAML
            • PKI
            • Custom
          • Built-in users
          • User profiles
          • Access agreement
          • Anonymous access
          • Manage authentication for multiple clusters
          • Token-based authentication services
          • Service accounts
          • Internal users
          • Operator privileges
            • Configure operator privileges
            • Operator-only functionality
            • Operator privileges for snapshot and restore
          • Looking up users without authentication
          • Controlling the user cache
        • User roles
          • Defining roles
            • Granting privileges for data streams and aliases
            • Role restriction
          • Built-in roles
          • Elasticsearch privileges
          • Kibana privileges
          • Mapping users and groups to roles
          • Authorization delegation
          • Authorization plugins
          • Controlling access at the document and field level
          • Submitting requests on behalf of other users
    • Manage spaces
    • Manage API keys
      • Elasticsearch API keys
      • Serverless project API keys
      • Elastic Cloud API keys
      • Elastic Cloud Enterprise API keys
    • Manage connectors
    • Monitoring
      • Monitoring overview
      • AutoOps
        • How to access AutoOps
        • AutoOps events
        • Overview
        • Deployment
        • Nodes
        • Indices
        • Shards
        • Template Optimizer
        • Notifications settings
        • Events Settings
        • Dismiss Events
        • AutoOps regions
        • AutoOps FAQ
      • Stack Monitoring
        • Stack Monitoring on Elastic Cloud deployments
        • Enable stack monitoring on ECK deployments
          • Connect to an external monitoring Elasticsearch cluster
          • When to use it
          • How it works
          • Audit logging
          • Override the Beats Pod Template
        • Enable stack monitoring on ECE deployments
          • Restrictions and limitations
        • Elasticsearch monitoring self-managed
          • Collecting monitoring data with {{agent}}
          • Collecting monitoring data with {{metricbeat}}
          • Collecting log data with {{filebeat}}
          • Legacy collection methods
            • Collectors
            • Exporters
            • Local exporters
            • HTTP exporters
            • Pausing data collection
        • Configure monitoring
          • Collect monitoring data with {{agent}}
          • Collect monitoring data with {{metricbeat}}
          • View monitoring data
          • Legacy collection methods
      • Monitoring Orchestrators
        • ECK metrics configuration
          • Enabling the metrics endpoint
          • Securing the metrics endpoint
          • Prometheus requirements
        • ECE platform monitoring
          • Access logs and metrics
          • Proxy Log Fields
          • Set the retention period for logging and metrics indices
      • Managing monitoring data
        • Visualizing monitoring data
          • Beats Metrics
          • {{es}} Metrics
          • Kibana alerts
          • {{kib}} Metrics
          • Logstash Metrics
          • Troubleshooting
        • Access performance metrics on Elastic Cloud
          • Access performance metrics
            • JVM memory pressure indicator
            • vCPU boosting and credits
          • Access performance metrics
            • JVM memory pressure indicator
            • vCPU boosting and credits
        • Configure Stack monitoring alerts
        • Configuring data streams/indices for monitoring
          • Configuring data streams created by Elastic Agent
          • Configuring data streams created by Metricbeat 8
          • Configuring indices created by Metricbeat 7 or internal collection
      • Health monitoring
      • Logging configuration
        • Elasticsearch log4j configuration (self-managed)
        • Update Elasticsearch logging levels
        • Elasticsearch deprecation logs
        • Kibana logging
          • Examples
          • Cli configuration
        • Security event audit logging
          • Enabling elasticsearch audit logs
            • Elasticsearch audit events
            • Logfile audit output
            • Logfile audit events ignore policies
            • Auditing search queries
          • Enabling Kibana audit logs
          • Enabling audit logs in orchestrated deployments
          • Correlating Kibana and Elasticsearch audit logs
    • Manage your Cloud organization
      • Billing
        • Cloud hosted deployment billing dimensions
        • Serverless project billing dimensions
          • Elastic Observability billing dimensions
          • Elasticsearch billing dimensions
          • Security billing dimensions
        • Billing models
        • Monitor and analyze usage
        • View billing history
        • Add your billing details
        • Update billing and operational contacts
        • Billing FAQ
        • Stop charges for a project or deployment
        • Manage your subscription
      • Operational emails
      • Service status
      • Tools and APIs
    • Manage your license
      • Manage your license in ECK
      • Manage your license in ECE
      • Manage your license in self-managed cluster
    • Maintenance
      • ECE maintenance
        • Deployments maintenance
          • Start and stop routing requests
          • Pause instance
        • Maintenance activities
          • Enable maintenance mode
          • Scale out your installation
          • Move nodes or instances from allocators
          • Perform ECE hosts maintenance
          • Delete ECE hosts
      • Start and stop services
        • Start and stop Elasticsearch
        • Start and stop Kibana
        • Restart a Cloud Hosted deployment
        • Restart an ECE deployment
        • Full Cluster restart and rolling restart procedures
      • Add and Remove Elasticsearch nodes
    • Upgrade
      • Prepare to upgrade
        • Upgrade Assistant
        • Index compatibility
      • Upgrade your orchestrator
        • Upgrade Elastic Cloud Enterprise
        • Upgrade Elastic Cloud on Kubernetes
      • Upgrade your deployment or cluster
        • Archived settings
          • Reading indices from older Elasticsearch versions
      • Internal upgrade processes
        • Saved object migrations
    • Uninstall
      • Uninstall Elastic Cloud Enterprise
      • Uninstall Elastic Cloud on Kubernetes
      • Uninstall a self-managed cluster
      • Delete a cloud deployment
  • Cloud account
    • Join or leave an organization
    • Update your email address
    • Change your password
    • Add a login method
    • Multifactor authentication
  • Troubleshoot
    • Troubleshoot
    • Elasticsearch
      • Fix common cluster issues
        • Watermark errors
        • Circuit breaker errors
        • High CPU usage
        • High JVM memory pressure
        • Red or yellow cluster health status
        • Rejected requests
        • Task queue backlog
        • Mapping explosion
        • Hot spotting
      • Diagnose unassigned shards
      • Add a missing tier to the system
      • Allow Elasticsearch to allocate the data in the system
      • Allow Elasticsearch to allocate the index
      • Indices mix index allocation filters with data tiers node roles to move through data tiers
      • Not enough nodes to allocate all shard replicas
      • Total number of shards for an index on a single node exceeded
      • Total number of shards per node has been reached
      • Troubleshooting corruption
      • Fix data nodes out of disk
        • Increase the disk capacity of data nodes
        • Decrease the disk usage of data nodes
      • Fix master nodes out of disk
      • Fix other role nodes out of disk
      • Start index lifecycle management
      • Start Snapshot Lifecycle Management
      • Restore from snapshot
      • Troubleshooting broken repositories
        • Diagnosing corrupted repositories
        • Diagnosing unknown repositories
        • Diagnosing invalid repositories
      • Addressing repeated snapshot policy failures
      • Troubleshooting an unstable cluster
      • Troubleshooting discovery
      • Troubleshooting monitoring
      • Troubleshooting transforms
      • Troubleshooting Watcher
      • Troubleshooting searches
      • Troubleshooting shards capacity health issues
      • Troubleshooting an unbalanced cluster
      • Capture diagnostics
      • Troubleshooting
        • Some settings are not returned via the nodes settings API
        • Authorization exceptions
        • Users command fails due to extra arguments
        • Users are frequently locked out of Active Directory
        • Certificate verification fails for curl on Mac
        • SSLHandshakeException causes connections to fail
        • Common SSL/TLS exceptions
        • Common Kerberos exceptions
        • Common SAML issues
        • Internal Server Error in Kibana
        • Setup-passwords command fails due to connection failure
        • Failures due to relocation of the configuration files
      • Troubleshooting
      • Index lifecycle management errors
      • Clients
        • Java
          • Missing required property
          • Error: No such method
          • Apache errors
          • Typed keys serialization
        • .NET
          • Logging
          • Logging with OnRequestCompleted
          • Logging with Fiddler
          • Debugging
            • Audit trail
            • Debug information
            • Debug mode
        • Node.js
        • Ruby
      • Elasticsearch for Apache Hadoop
    • Kibana
      • Using Kibana server logs
      • Trace Elasticsearch query to the origin in Kibana
      • Capture diagnostics
      • Access
      • Error: Server not ready
      • Migration failures
      • Troubleshooting
      • Troubleshoot
      • Troubleshooting
      • Troubleshooting and limitations
      • Alerts
      • Troubleshooting
    • Deployments
      • Serverless
      • Elastic Cloud
        • Monitoring
      • Elastic Cloud Enterprise
        • Common issues
        • Use the emergency roles token
        • Remove Elastic Cloud Enterprise
        • Verify ZooKeeper Sync Status
        • Rebuilding a broken Zookeeper quorum
        • Troubleshooting container engines
        • Run ECE diagnostics tool
        • Ask for help
        • Finding deployments, finding problems
        • Heap dumps
        • Thread dumps
      • Kubernetes
        • Common problems
        • Troubleshooting methods
        • Run eck-diagnostics
        • JVM heap dumps
      • Troubleshooting
    • Monitoring
      • AutoOps
      • Unavailable nodes
      • Unavailable shards
      • Performance
      • High memory pressure
      • High availability
      • Cluster response time
      • Node moves and outages
      • Deployment health warnings
      • Node bootlooping
    • Ingest tools
      • Logstash
        • Plugins
          • Kafka
          • Azure Event Hub
        • Health report pipelines
      • Fleet and Elastic Agent
        • Common problems
        • Frequently asked questions
      • Elastic Logging Plugin for Docker
    • Security
      • Detection rules
      • {{elastic-defend}}
      • Indicators of compromise
      • Agentless integrations
    • Observability
      • Explore data
      • Inspect
      • Synthetics
      • Troubleshoot mapping issues
      • Logs
      • APM
        • Common problems
        • What happens when APM Server or Elasticsearch is down?
        • APM Server response codes
        • Processing and performance
        • APM Server binary debugging
        • APM Server performance diagnostic
        • APM Go Agent
        • APM iOS Agent
        • APM Java Agent
        • APM .NET agent
        • APM Node.js Agent
        • APM PHP Agent
          • Agent is not instrumenting code
          • Collection of diagnostic information
        • APM Python Agent
        • APM Ruby Agent
        • APM Real User Monitoring JavaScript Agent
        • Known issues
      • Amazon Data Firehose
      • Universal Profiling
        • Troubleshoot the backend
      • Infrastructure monitoring
        • Understanding "no results found" message
      • SLOs
  • Content to pull from
    • APM Android agent
      • Release notes
    • APM iOS agent
      • v1.0.0
      • v1.0.1
    • APM Ruby agent
      • Ruby Agent version 4.x
    • Elastic Cloud on k8s
      • Audit logging
      • Installation
      • Learn more about ECK
      • Access Elastic Stack services
      • Advanced topics
      • Running in air-gapped environments
      • Custom HTTP certificate
      • Deploy ECK in your Kubernetes cluster
      • Secure settings
      • Deploy a FIPS compatible version of ECK
      • Install ECK using the YAML manifests
      • Install ECK
      • Nodes orchestration
      • Overview
      • Access the Elasticsearch endpoint
      • Rotate auto-generated credentials
      • SAML Authentication
      • Secure the Elastic Stack
      • Security
      • Services
      • Supported versions
      • TLS certificates
      • Upgrade the Elastic Stack version
      • Users and roles
    • Elastic Cloud Enterprise
      • Optional settings
      • Re-running the ECE upgrade
      • Sign outgoing SAML messages
      • Access Kibana
      • Add custom bundles and plugins to your deployment
      • Add Elasticsearch user settings
      • Administering deployments
      • Administering your installation
      • Access the Elasticsearch API console
      • Deployment autoscaling
      • Change your deployment configuration
      • How do I resolve node bootlooping?
      • Secure your settings
      • Create a hosted deployment
      • Delete a deployment
      • How do I resolve deployment health warnings?
      • Disable an Elasticsearch data tier
      • Enable auditing
      • Finding deployments, finding problems
      • Generate roles tokens
      • Ingest data with Node.js on Elastic Cloud Enterprise
      • Ingest data with Python on Elastic Cloud Enterprise
      • Ingest data from Beats to Elastic Cloud Enterprise with {{ls}} as a proxy
      • Ingest data from a relational database into Elastic Cloud Enterprise
      • Ingest logs from a Node.js web application using Filebeat
      • Ingest logs from a Python application using Filebeat
      • Ingesting data from your application
      • Install ECE offline
      • Enable Integrations Server through the API
      • Request routing
      • Add APM user settings
      • Add Enterprise Search user settings
      • Manage your Integrations Server
      • Add Kibana user settings
      • Manage your Kibana instance
      • Migrate to index lifecycle management
      • Migrating data
      • Keep your clusters healthy
      • Reset the password for the elastic user
      • Secure your settings
      • Restore a snapshot across clusters
      • Restore a deployment
      • Revoke roles tokens
      • Secure your clusters with Kerberos
      • Secure your clusters with OpenID Connect
      • Secure your clusters with Active Directory
      • Secure your clusters with JWT
      • Secure your clusters with LDAP
      • Secure your clusters with SAML
      • Secure your clusters
      • Securing your installation
      • Work with snapshots
      • Working with deployments
      • Terminate a deployment
      • Traffic Filtering
      • IP traffic filters
      • Manage traffic filtering through the API
      • Troubleshooting
      • Upgrade versions
      • Upgrade your installation
      • Manage data from the command line
      • Editing your user settings
      • Introducing Elastic Cloud Enterprise
    • Elastic Cloud Heroku
      • About
      • Access Kibana
      • Keep track of deployment activity
      • Edit {{es}} user settings
      • Add plugins provided with Elasticsearch Add-On for Heroku
      • Add plugins and extensions
      • Analyze unassigned shards using the {{es}} API
      • Analyze unassigned shards using the Kibana UI
      • Deployment autoscaling
      • How do I resolve node bootlooping?
      • Configure your deployment
      • Configuring your deployment
      • Secure your settings
      • CPU usage exceeds the allowed threshold on master nodes
      • Upload custom plugins and bundles
      • Snapshot and restore with custom repositories
      • Delete your deployment
      • How do I resolve deployment health warnings?
      • Edit your user settings
      • Enable Kibana
      • Enable logging and monitoring
      • Introducing Elasticsearch Add-On for Heroku
      • JVM heap usage exceeds the allowed threshold on master nodes
      • Edit APM user settings
      • Edit Kibana user settings
      • How does high memory pressure affect performance?
      • Migrate internal indices
      • Migrate your Elasticsearch data
      • How to set up monitoring
      • Monitoring your deployment
      • Full disk on multiple-nodes deployment
      • Some nodes are unavailable and are displayed as missing
      • Reset the elastic user password
      • Plan for production
      • Custom endpoint aliases
      • Remediate common issues returned by the cluster allocation explain API
      • Work with snapshots
      • Restrictions and limitations
      • Access performance metrics
      • Secure your clusters with Kerberos
      • Secure your clusters with OpenID Connect
      • Secure your clusters with JWT
      • Secure your clusters with SAML
      • Securing your deployment
      • Full disk on single-node deployment
      • Snapshot and restore
      • Traffic Filtering
      • IP traffic filters
      • GCP Private Service Connect traffic filters
      • Azure Private Link traffic filters
      • AWS PrivateLink traffic filters
      • Upgrade versions
      • Is my cluster really highly available?
      • Why are my cluster response times suddenly so much worse?
      • Why are my shards unavailable?
      • Diagnose unavailable nodes
      • Why is performance degrading over time?
      • Sign outgoing SAML messages
    • Elastic Cloud
      • Service Status API
      • Subscribe to Individual Regions/Components
      • About Elasticsearch Service
      • Access Kibana
      • Monitor and analyze your account usage
      • Edit user account settings
      • Keep track of deployment activity
      • Edit {{es}} user settings
      • Other deployment operations
      • Organization operations
      • Deployment autoscaling
      • Using Elastic Consumption Units for billing
      • Check your billing history
      • Billing models
      • Stop charges for a deployment
      • Your account and billing
      • Adding data to Elasticsearch
      • How do I resolve node bootlooping?
      • Configure index management
      • Secure your settings
      • Upload custom plugins and bundles
      • Snapshot and restore with custom repositories
      • Change your configuration
      • Delete your deployment
      • How do I resolve deployment health warnings?
      • Disable an Elasticsearch data tier
      • Edit your user settings
      • Enable logging and monitoring
      • Elasticsearch Service FAQ
      • Technical FAQ
      • Getting help
      • Sign up using an existing email address
      • Ingest data with Node.js on Elasticsearch Service
      • Ingest data with Python on Elasticsearch Service
      • Ingest data from Beats to Elasticsearch Service with {{ls}} as a proxy
      • Ingest data from a relational database into Elasticsearch Service
      • Ingest logs from a Node.js web application using Filebeat
      • Ingest logs from a Python application using Filebeat
      • How do I sign up?
      • Introducing Elasticsearch Service
      • Ingesting data from your application
      • Invite members to your organization
      • Request routing
      • Edit APM user settings
      • Add App Search user settings
      • Add Enterprise Search user settings
      • Edit Kibana user settings
      • How does high memory pressure affect performance?
      • Migrate internal indices
      • Migrate to index lifecycle management
      • Migrating data
      • How to set up monitoring
      • Monitoring your deployment
      • Notifications domain allowlist
      • Reset the elastic user password
      • Plan for production
      • Preparing a deployment for production
      • Custom endpoint aliases
      • Restart your deployment
      • Restore a snapshot across clusters
      • Work with snapshots
      • Access performance metrics
      • Is my cluster really highly available?
      • Why are my cluster response times suddenly so much worse?
      • Why are my shards unavailable?
      • Diagnose unavailable nodes
      • Why is performance degrading over time?
      • Secure your clusters with Kerberos
      • Secure your clusters with OpenID Connect
      • Secure your clusters with JWT
      • Set up OpenID Connect with Azure, Google, or Okta
      • Set up SAML with Microsoft Entra ID
      • Secure your clusters with SAML
      • Securing your deployment
      • Choose a subscription level
      • Service status
      • Sign outgoing SAML messages
      • Snapshot and restore
      • Check your subscription overview
      • Traffic Filtering
      • IP traffic filters
      • GCP Private Service Connect traffic filters
      • Manage traffic filtering through the API
      • Azure Private Link traffic filters
      • AWS PrivateLink traffic filters
      • Upgrade versions
      • User roles and privileges
      • Enable Watcher
      • Manage data from the command line
    • Elasticsearch Curator
      • About
      • Curator and Index Lifecycle Management
    • Serverless
      • Cloud Native Vulnerability Management dashboard
      • {{connectors-app}}
      • Agentless integrations FAQ
      • AI Assistant Knowledge Base
      • Applications and services
      • Attack Discovery
      • Quickstart: Collect data with AWS Firehose
      • Connect to your own local LLM
      • CSPM privilege requirements
      • Custom roles
      • {{data-sources-cap}}
      • Using logsdb index mode with {{sec-serverless}}
      • Client libraries
      • Connect to your endpoint
      • Developer tools
      • Serverless differences
      • Explore your data
      • Get started
      • REST APIs
      • Upload a file
      • Ingest data through API
      • Ingest your data
      • k-nearest neighbor (kNN) search
      • Performance and general settings
      • Playground
      • Semantic search
      • The search API
      • Search your data
      • Endpoint protection rules
      • Check your billing history
      • Stop charges for a project
      • Check your subscription
      • Billing
      • Manage users and roles
      • Trained model autoscaling
      • Monitor your account usage
      • Monitor serverless status
      • Sign up for Elastic Cloud
      • Update your user profile
      • Incident management
      • Index management
      • Infrastructure and hosts
      • Ingest AWS Security Hub data
      • Ingest CNCF Falco data
      • {{ingest-pipelines-cap}}
      • Ingest third-party cloud security data
      • Ingest Wiz data
      • Elastic Cloud Serverless
      • {{ml-cap}}
      • {{maint-windows-cap}}
      • {{maps-app}}
      • Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
      • Add a service name to logs
      • Aggregation options
      • {{observability}} AI Assistant
      • Alerting
      • Analyze and compare hosts
      • Act on data
      • AWS Lambda functions
      • APM agents
      • Collect metrics
      • Limitations
      • Upstream OpenTelemetry Collectors and language SDKs
      • Resource attributes
      • OpenTelemetry
      • Create rules and alerts
      • Span compression
      • Create custom links
      • Learn about data types
      • Dependencies
      • Distributed tracing
      • Errors
      • Filter and search data
      • Filters
      • Find transaction latency and failure correlations
      • Get started with traces and APM
      • Infrastructure
      • Integrate with machine learning
      • Interpret data
      • Use APM securely
      • Settings
      • Logs
      • Metrics
      • Observe Lambda functions
      • Advanced queries
      • Reduce storage
      • Collect application data
      • Service map
      • Service Overview
      • Services
      • Trace sample timeline
      • Traces
      • Track deployments with annotations
      • Transaction sampling
      • Transactions
      • Troubleshooting
      • Drill down into data
      • Overviews
      • View and analyze data
      • Application performance monitoring (APM)
      • Configure case settings
      • Cases
      • Configure settings
      • Stream application logs
      • Create and manage cases
      • Create an SLO
      • APM anomaly
      • Custom threshold
      • Error count threshold
      • Failed transaction rate threshold
      • Inventory
      • Latency threshold
      • Create and manage rules
      • SLO burn rate
      • Detect metric anomalies
      • Explore logs
      • ECS formatted application logs
      • Filter and aggregate logs
      • Get started with system metrics
      • Get started
      • Understanding "no results found" message
      • Analyze infrastructure and host metrics
      • Logs
      • Machine learning
      • Data set quality
      • Synthetic monitor status
      • Synthetic monitoring
      • Parse and route logs
      • Plaintext application logs
      • Quickstart: Monitor your Kubernetes cluster with Elastic Agent
      • Quickstart: Monitor hosts with {{agent}}
      • Rate aggregation
      • {{apm-agent}} log sending
      • Observability overview
      • Service-level objectives (SLOs)
      • Stream any log file
      • Analyze monitor data
      • Use the CLI
      • Configure a Synthetics project
      • Write a synthetic test
      • Grant users access to secured resources
      • Use a Synthetics project
      • Use the Synthetics UI
      • Get started
      • Scripting browser monitors
      • Configure lightweight monitors
      • Manage monitors
      • Manage data retention
      • Multifactor Authentication for browser monitors
      • Configure individual monitors
      • Work with params and secrets
      • Monitor resources on private networks
      • Use the Synthetics Recorder
      • Scale and architect a deployment
      • Synthetics Encryption and Security
      • Configure Synthetics settings
      • Troubleshooting
      • SLO burn rate breaches
      • Threshold breaches
      • Troubleshoot logs
      • Troubleshooting
      • View alerts
      • View infrastructure metrics by resource type
      • Manage your project
      • Data
      • Alerts and insights
      • Content
      • Quickstart: Monitor hosts with OpenTelemetry
      • {{rules-app}}
      • Saved objects
      • Rules
      • Add and manage exceptions
      • Notes
      • Advanced behavioral detections
      • Advanced Entity Analytics
      • Advanced settings
      • Prevent {{agent}} uninstallation
      • Agentless integrations
      • Generate, customize, and learn about {{esql}} queries
      • Elastic AI Assistant
      • AI for Security
      • Use cases
      • Identify, investigate, and document threats
      • Suppress alerts
      • Alerts
      • Run Osquery from alerts
      • Monitor and troubleshoot rule executions
      • Allowlist {{elastic-endpoint}} in third-party antivirus apps
      • View risk score data
      • Asset criticality
      • Automated response actions
      • Automatic Import
      • Behavioral detection use cases
      • Benchmarks
      • Benchmarks
      • Blocklist
      • Use building block rules
      • Create and manage cases
      • Cases
      • Cases requirements
      • Configure case settings
      • Cloud Security
      • Cloud Security Posture
      • Cloud Security Posture
      • Cloud Security Posture
      • Cloud workload protection for VMs
      • Configure network map data
      • Configure an integration policy for {{elastic-defend}}
      • Connect to Azure OpenAI
      • Connect to Amazon Bedrock
      • Connect to Google Vertex AI
      • Connect to OpenAI
      • Findings page
      • Findings page
      • Get started with CSPM for Azure
      • Get started with CSPM for GCP
      • Get started with CSPM for AWS
      • Frequently asked questions (FAQ)
      • Cloud security posture management
      • Dashboards
      • Data Quality
      • {{data-sources-cap}} in Elastic Security
      • Enable access for macOS Ventura and higher
      • Deploy on macOS with MDM
      • Detection engine overview
      • Entity Analytics
      • Detection & Response
      • Detections requirements
      • {{elastic-defend}} requirements
      • Configure data volume
      • Turn off diagnostic data for {{elastic-defend}}
      • Event capture and {{elastic-defend}}
      • {{elastic-defend}} feature privileges
      • Configure endpoint protection with {{elastic-defend}}
      • {{elastic-endpoint}} self-protection features
      • Endpoints
      • Entity risk scoring
      • Capture environment variables
      • Entity risk scoring requirements
      • Event filters
      • Examine Osquery results
      • Explore your data
      • Get started with KSPM
      • Host isolation exceptions
      • Hosts page
      • Indicators of compromise
      • Ingest data
      • Install Elastic Defend
      • Enable access for macOS Monterey
      • Launch Timeline from investigation guides
      • Run Osquery from investigation guides
      • Investigation tools
      • Isolate a host
      • Kubernetes security posture management
      • File system monitoring (Linux)
      • LLM connector guides
      • Large language model performance matrix
      • Detect anomalies
      • Manage {{elastic-defend}}
      • {{ml-cap}} job and rule requirements
      • Network page
      • Optimize {{elastic-defend}}
      • Use placeholder fields in Osquery queries
      • Add Osquery Response Actions
      • Overview
      • {{elastic-sec}} overview
      • Policies
      • Frequently asked questions (FAQ)
      • Security posture management overview
      • Use Elastic prebuilt rules
      • Configure protection updates
      • Query alert indices
      • Osquery
      • Reduce notifications and alerts
      • {{elastic-sec}} requirements
      • Configure third-party response actions
      • Response actions history
      • Endpoint response actions
      • Rule exceptions
      • Detection rule monitoring
      • MITRE ATT&CK® coverage
      • Create a detection rule
      • Manage detection rules
      • Create runtime fields
      • Self-healing rollback (Windows)
      • Session View
      • Create and manage shared exception lists
      • Add alerts to cases
      • Spaces and {{elastic-sec}}
      • Third-party response actions
      • Enable threat intelligence integrations
      • Timeline templates
      • Timeline
      • Triage alerts
      • Elastic Defend
      • Trusted applications
      • Detection rules
      • Tune detection rules
      • Optimizing anomaly results
      • Turn on risk scoring
      • Elastic Security UI
      • Uninstall {{agent}}
      • Users page
      • Create and manage value lists
      • View alert details
      • Visual event analyzer
      • Visualize alerts
      • Cloud Native Vulnerability Management dashboard
      • Frequently asked questions (FAQ)
      • Get started with CNVM
      • Cloud native vulnerability management
      • Troubleshoot SLOs
      • Spaces
      • {{tags-app}}
      • {{transforms-app}}
      • {{es}}
      • Elastic Observability
    • Elasticsearch Hadoop
      • Documentation sections
    • Elasticsearch
      • Usage example
      • Active Directory user authentication
      • Overview
      • Text analysis
      • Autoscaling deciders
      • Fixed decider
      • Frozen existence decider
      • Frozen shards decider
      • Frozen storage decider
      • Machine learning decider
      • Proactive storage decider
      • Reactive storage decider
      • Bootstrap Checks for {{xpack}}
      • Bootstrap Checks
      • Built-in roles
      • Built-in users
      • Setting passwords for native and built-in users
      • Start the {{stack}} with security enabled automatically
      • Data management
      • Roll up or transform your data
      • Data streams
      • Data tiers
      • Defining roles
      • Document level security
      • Indices and documents
      • Run {{es}}
      • Add data to {{es}}
      • {{es}} security principles
      • Examples
      • Getting started
      • Using {{esql}}
      • {{esql}}
      • Setting up field and document level security
      • Field level security
      • File-based user authentication
      • FIPS 140-2
      • Basics: Full-text search and filtering
      • Basics: Index and search using APIs
      • How it works
      • Config ignore_missing_component_templates
      • {{ilm-init}}: Manage the index lifecycle
      • Index management in {{kib}}
      • Index Shard Allocation
      • Analysis
      • Mapper
      • Enrich your data
      • Ingest pipelines in Search
      • Ingest pipelines
      • Installing Elasticsearch
      • Restricting connections with IP filtering
      • JWT authentication
      • Kerberos authentication
      • kNN search
      • LDAP user authentication
      • Mapping users and groups to roles
      • Mapping
      • Monitor a cluster
      • Overview
      • Monitoring in a production environment
      • Native user authentication
      • Configuring single sign-on to the {{stack}} using OpenID Connect
      • OpenID Connect authentication
      • Overview
      • Query DSL
      • Query and filter context
      • Index recovery prioritization
      • Retrievers
      • Role mapping resources
      • Overview
      • Run {{es}} locally
      • Configuring SAML single-sign-on on the {{stack}}
      • SAML authentication
      • Get ready for production
      • Search and analyze data
      • Search your data
      • Search with synonyms
      • The search API
      • Secure the {{stack}}
      • Monitoring and security
      • Secure settings
      • Set up basic security plus HTTPS
      • Set up basic security
      • Security files
      • Limitations
      • Semantic search with the {{infer}} API
      • Semantic search
      • User authentication
      • Set up {{es}}
      • Index-level shard allocation filtering
      • The shard request cache
      • Snapshot and restore
      • Restore a snapshot
      • Starting Elasticsearch
      • Stopping Elasticsearch
      • Transforming data
      • Watcher
      • Autoscaling
      • Rolling up historical data
    • Fleet and Elastic Agent
      • {{beats}} and {{agent}} capabilities
      • Restrictions for {{serverless-full}}
      • Quick starts
    • Ingest overview
      • Ingesting data into {{es}}
    • Kibana
      • Connectors
      • Alerting
      • APM settings
      • Add data
      • Run API requests with Console
      • Rollup Jobs
      • Create a {{data-source}}
      • Mutual TLS with {{es}}
      • {{esql}}
      • Quick start
      • Inference endpoints UI
      • Install {{kib}}
      • What is Kibana?
      • Authentication
      • {{kib}} concepts
      • {{kib}} role management
      • Logging settings
      • Maintenance windows
      • Stack Management
      • Manage data views
      • Manage saved objects
      • Tags
      • Maps
      • Osquery
      • Playground
      • Reporting and sharing
      • Reporting
      • Role mappings
      • Installing sample data
      • Save a query
      • Saved Object IDs
      • AI Assistant
      • Connection details
      • Configure reporting
      • Secure settings
      • Security
      • Set the time range
      • Set up
      • Securing access to {{kib}}
      • Roll back to a previous version of {{kib}}
      • Upgrade {{kib}}
      • Configure security
      • Watcher
      • AIOps Labs
      • {{anomaly-detect-cap}}
      • {{dfanalytics-cap}}
      • Granting access to {{kib}}
      • FIPS 140-2
      • Security
      • Spaces
    • Logstash
      • Health Report Pipeline Flow: Worker Utilization
      • Health Report Pipeline Status
      • Troubleshooting
      • Troubleshooting {{ls}}
    • Observability
      • Add a service name to logs
      • Aggregation options
      • Analyze and compare hosts
      • Act on data
      • Advanced queries
      • APM agents
      • Create rules and alerts
      • APM Anomaly
      • Collect application data
      • Common problems
      • Configure APM Server
      • Find transaction latency and failure correlations
      • Create custom links
      • Spans
      • Traces
      • Learn about data types
      • Dependencies
      • Error count threshold
      • Errors
      • Failed transaction rate threshold
      • Filter and search data
      • Filters
      • Get started
      • Infrastructure
      • Interpret data
      • Observe Lambda functions
      • Latency threshold
      • Logs
      • Integrate with machine learning
      • Metrics
      • AWS Lambda Functions
      • Collect metrics
      • Upstream OpenTelemetry Collectors and language SDKs
      • Limitations
      • Resource attributes
      • OpenTelemetry
      • Reduce storage
      • Transaction sampling
      • Use APM securely
      • Service Map
      • Service overview
      • Services
      • Settings
      • Trace sample timeline
      • Traces
      • Track deployments with annotations
      • Transactions
      • Drill down into data
      • Overviews
      • View and analyze data
      • Application performance monitoring (APM)
      • Applications and services
      • Stream application logs
      • Quickstart: Collect data with AWS Firehose
      • Configure settings
      • Create and manage rules
      • Alerting
      • Cases
      • Custom threshold
      • Logs Explorer
      • Understanding "no results found" message
      • Incident management
      • Infrastructure and hosts
      • Inventory
      • Detect metric anomalies
      • Logs
      • ECS formatted application logs
      • Filter and aggregate logs
      • Get started with system metrics
      • Parse and organize logs
      • Plaintext application logs
      • {{apm-agent}} log sending
      • Stream any log file
      • Troubleshoot logs
      • Configure case settings
      • Open and manage new cases
      • Data set quality
      • Analyze infrastructure and host metrics
      • Quickstart: Monitor your Kubernetes cluster with {{agent}}
      • Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
      • Monitor status
      • Synthetic monitoring
      • Observability AI Assistant
      • Get started
      • What is Elastic {{observability}}?
      • Quickstart: Monitor hosts with {{agent}}
      • Quickstart: Monitor hosts with OpenTelemetry
      • Rate aggregation
      • SLO burn rate
      • Create an SLO
      • Troubleshoot SLOs
      • Service-level objectives (SLOs)
      • Analyze monitor data
      • Use the CLI
      • Configure projects
      • Write a synthetic test
      • Grant users access to secured resources
      • Use {{project-monitors-cap}}
      • Use the {{synthetics-app}}
      • Get started
      • Scripting browser monitors
      • Configure lightweight monitors
      • Manage monitors
      • Manage data retention
      • Multi-factor Authentication
      • Configure individual monitors
      • Work with params and secrets
      • Monitor resources on private networks
      • Use the Synthetics Recorder
      • Scale and architect a deployment
      • Synthetics Encryption and Security
      • Configure Synthetics settings
      • Troubleshooting
      • SLO burn rate breaches
      • Threshold breaches
      • Troubleshooting
      • View infrastructure metrics by resource type
      • View alerts
    • Security
      • About detection rules
      • Add and manage exceptions
      • Notes
      • Endpoints
      • Advanced behavioral detections
      • Advanced Entity Analytics
      • Configure advanced settings
      • Prevent {{agent}} uninstallation
      • Agentless integrations
      • AI Assistant Knowledge Base
      • AI for Security
      • Suppress detection alerts
      • Run Osquery from alerts
      • Manage detection alerts
      • Monitor and troubleshoot rule executions
      • Allowlist {{elastic-endpoint}} in third-party antivirus apps
      • View and analyze risk score data
      • Configure updates for protection artifacts
      • Asset criticality
      • Connect to Azure OpenAI
      • Connect to Amazon Bedrock
      • Connect to OpenAI
      • Triage alerts
      • Use cases
      • Identify, investigate, and document threats
      • Attack Discovery
      • Automated response actions
      • Automatic import
      • Behavioral detection use cases
      • Benchmarks
      • Blocklist
      • About building block rules
      • Cases requirements
      • Configure case settings
      • Open and manage cases
      • Cases
      • Cloud Security Posture dashboard
      • Cloud Security
      • Cloud Security Posture dashboard
      • Cloud workload protection for VMs
      • Configure network map data
      • Configure an integration policy for {{elastic-defend}}
      • Connect to your own local LLM
      • Connect to Google Vertex
      • Benchmarks
      • Findings page
      • Get started with CSPM for Azure
      • Get started with CSPM for GCP
      • Get started with CSPM for AWS
      • Cloud Security Posture dashboard
      • CSPM privilege requirements
      • Frequently asked questions (FAQ)
      • Cloud security posture management
      • Dashboards
      • Data Quality dashboard
      • {{data-sources-cap}} in Elastic Security
      • Enable access for macOS Ventura and higher
      • Enable access for macOS Monterey
      • Deploy on macOS with MDM
      • Detections and alerts
      • Entity Analytics dashboard
      • Detection & Response dashboard
      • Using logsdb index mode with {{elastic-sec}}
      • Detections requirements
      • Rule exceptions
      • {{elastic-defend}} requirements
      • Optimize {{elastic-defend}}
      • Configure data volume
      • Turn off diagnostic data for {{elastic-defend}}
      • Event capture and {{elastic-defend}}
      • {{elastic-defend}} feature privileges
      • Configure endpoint protection with {{elastic-defend}}
      • Endpoint protection rules
      • {{elastic-endpoint}} self-protection features
      • Entity risk scoring
      • Capture environment variables
      • Entity risk scoring requirements
      • {{elastic-sec}} overview
      • Enable threat intelligence integrations
      • Elastic Security UI
      • Generate, customize, and learn about {{esql}} queries
      • Event filters
      • Findings page
      • Get started with KSPM
      • Host isolation exceptions
      • Isolate a host
      • Hosts page
      • Indicators of compromise
      • Ingest AWS Security Hub data
      • Ingest data to Elastic Security
      • Ingest CNCF Falco data
      • Ingest third-party cloud security data
      • Ingest Wiz data
      • Install {{elastic-defend}}
      • Launch Timeline from investigation guides
      • Run Osquery from investigation guides
      • Investigation tools
      • Kubernetes security posture management
      • Configure Linux file system monitoring
      • Set up connectors for large language models (LLM)
      • Large language model performance matrix
      • Anomaly detection
      • Machine learning job and rule requirements
      • Network page
      • Use placeholder fields in Osquery queries
      • Add Osquery Response Actions
      • Overview dashboard
      • Policies
      • Install and manage Elastic prebuilt rules
      • Query alert indices
      • Reduce notifications and alerts
      • Configure third-party response actions
      • Response actions history
      • Endpoint response actions
      • Detection rule monitoring dashboard
      • MITRE ATT&CK® coverage
      • Create a detection rule
      • Manage detection rules
      • Create runtime fields in {{elastic-sec}}
      • Explore
      • Manage {{elastic-defend}}
      • {{elastic-sec}} requirements
      • AI Assistant
      • Frequently asked questions (FAQ)
      • Security posture management overview
      • Spaces and {{elastic-sec}}
      • Configure self-healing rollback for Windows endpoints
      • Session View
      • Create and manage shared exception lists
      • Add detection alerts to cases
      • Third-party response actions
      • Timeline templates
      • Timeline
      • Trusted applications
      • Detection rules
      • {{elastic-defend}}
      • Optimizing anomaly results
      • Tune detection rules
      • Turn on the risk scoring engine
      • Uninstall {{agent}}
      • Osquery
      • Users page
      • Create and manage value lists
      • View detection alert details
      • Examine Osquery results
      • Visual event analyzer
      • Visualize detection alerts
      • Cloud Native Vulnerability Management Dashboard
      • Cloud Native Vulnerability Management Dashboard
      • Frequently asked questions (FAQ)
      • Get started with CNVM
      • Cloud native vulnerability management
    • Elastic Stack
      • Installing in an air-gapped environment
      • Tutorial 2: Securing a self-managed {{stack}}
      • Installing the Elastic Stack
      • Tutorial 1: Installing a self-managed {{stack}}
      • Overview
      • Upgrade on Elastic Cloud
      • Upgrade Elastic on-prem
      • Upgrade to Elastic 9.0.0-beta1
      • Upgrade {{es}}
      • Upgrade {{kib}}
    • Machine learning
      • What is Elastic {{ml-app}}?
      • {{anomaly-detect-cap}}
      • {{dfanalytics-cap}}
    • Starting with the Elasticsearch Platform and its Solutions
      • Get Elastic
      • Getting help
      • An overview of the {{stack}}
      • Troubleshooting and FAQs

On this page

Edit this page
  1. Elastic /
  2. Elastic documentation!!!! /
  3. Explore and analyze /
  4. Machine learning /
  5. Anomaly detection /

Resources

This section contains further resources for using anomaly detection.

  • Limitations
  • Function reference
  • Supplied configurations
  • Troubleshooting and FAQ
Previous
Exporting and importing {{ml}} jobs
Next
Limitations

2024, Elasticsearch B.V. All Rights Reserved.

Made with Elastic.Markdown and Shibuya theme.