1. Elastic Docs /
  2. Solutions and use cases /
  3. Security solution /
  4. AlertZero

Watches and Workers

Reference for every Watch and Worker.

Triage Watch

Detection Watch

Hunt Watch

Forensics Watch

Previous
Create runtime fields in Elastic Security
Next
AI-assisted operations
  • View as Markdown
  • Report a docs issue
  • Edit this page
  • Learn how to contribute
Get started free
  • 14-day free trial
  • All features included
  • No setup required
On this page
  • Triage Watch
  • Detection Watch
  • Hunt Watch
  • Forensics Watch
  • Elastic fundamentals
  • Elastic Stack
  • Deploy and manage
  • Solutions and use cases
  • Manage data
  • Explore and analyze
  • Manage your Cloud account and preferences
  • Troubleshoot
  • Release notes
  • Reference
  • Contribute to the docs
  • Extend and contribute
  • Elastic fundamentals
    • Evaluate Elastic during a trial
    • Solutions overview
    • Deployment options
    • The Elastic Stack
    • Versioning and availability
    • How to use the documentation
      • Machine-readable docs
    • Glossary
  • Elastic Stack
    • Elasticsearch
    • Kibana
    • Logstash
  • Deploy and manage
    • Deploy
      • Detailed deployment comparison
      • Elastic Cloud
        • Compare Cloud Hosted and Serverless
        • Sign up
          • Subscribe from a marketplace
            • Upgrade a trial to a marketplace subscription
            • AWS Marketplace
            • Azure Native Service
              • Logs and metrics
              • Network security
              • Customer-managed encryption keys
              • Troubleshooting
            • Google Cloud Platform Marketplace
            • Heroku
              • Install the add-on
                • Remove the add-on
              • Access the console
              • Work with Elasticsearch
              • Migrate between plans
              • Hardware
              • Regions
        • Elastic Cloud Serverless
          • Create a serverless project
          • Regions
          • Project settings
          • Project connection details
          • Manage projects with API
          • Serverless FAQ
        • Elastic Cloud Hosted
          • Create an Elastic Cloud Hosted deployment
            • Available stack versions
          • Access Kibana
          • Plan for production
          • Manage deployments
            • Configure
              • Manage hardware profiles
                • Customize instance configuration
              • Customize deployment components
              • Edit Elastic Stack settings
              • Custom endpoint aliases
            • Manage Integrations Server
              • Switch from APM to Integrations Server
            • Find your Cloud ID
          • vCPU boosting and credits
          • Manage deployments using the Elastic Cloud API
          • Keep track of deployment activity
          • Restrictions and known problems
        • FedRAMP authorized Cloud offerings
        • Tools and APIs
      • Elastic Cloud Enterprise
        • Service-oriented architecture
        • Install an orchestrator
          • Prepare your environment
            • Hardware prerequisites
            • Software prerequisites
            • System configuration
            • Networking prerequisites
            • IPv6 support
              • Set up IPv6 on AWS
            • Users and permissions prerequisites
            • High availability
            • Separation of roles
            • Load balancers
            • JVM heap size
            • Wildcard DNS record and certificates
          • Install ECE
            • Identify the deployment scenario
            • Configure your operating system
              • Ubuntu
              • RHEL
              • SUSE
            • Installation procedures
              • Deploy a small installation
              • Deploy a medium installation
              • Deploy a large installation
              • Deploy using Podman
              • Migrate ECE to Podman hosts
                • Migrating to Podman 5
            • Post-installation steps
            • Install ECE on additional hosts
              • Manage roles tokens
            • Ansible playbook
            • Statistics collected by Elastic Cloud Enterprise
          • Air-gapped install
            • With your private Docker registry
            • Without a private Docker registry
            • Available Docker images
          • Configure ECE
            • Assign roles to hosts
            • System deployments configuration
              • Default system deployment versions
            • Manage deployment templates
              • Tag your allocators
              • Edit instance configurations
              • Create instance configurations
              • Create templates
              • Configure default templates
              • Configure index management
              • Data tiers and autoscaling support
              • Integrations server support
              • Default instance configurations
            • Change the ECE API URL
            • Change endpoint URLs
            • Enable custom endpoint aliases
            • Proxy Protocol
            • Manage your allocators capacity
            • Configure allocator affinity
            • Change allocator disconnect timeout
            • Manage Elastic Stack versions
        • Log into the Cloud UI
        • Manage deployments
          • Deployment templates
          • Create a deployment
          • Access Kibana
          • Connect to Elasticsearch
          • Configure
            • Customize deployment components
            • Edit stack settings
              • Elasticsearch user settings
              • Kibana user settings
              • APM user settings
              • Enterprise search user settings
            • Resize deployment
            • Custom endpoint aliases
            • Resource overrides
            • Advanced cluster configuration
          • Search and filter deployments
          • Keep track of deployment activity
          • Manage Integrations Server
            • Enable Integrations Server through the API
            • Switch from APM to Integrations Server
        • Tools and APIs
      • Elastic Cloud on Kubernetes
        • Deploy an orchestrator
          • Install
            • YAML manifests
            • Helm chart
            • Required RBAC permissions
            • Deploy ECK on Openshift
              • Deploy the operator
              • Deploy an Elasticsearch instance with a route
              • Deploy a Kibana instance with a route
              • Grant privileged permissions to Beats
              • Grant host access permission to Elastic Agent
            • Deploy ECK on GKE Autopilot
            • Deploy ECK on Google Distributed Cloud air-gapped
            • FIPS compatibility
          • Air-gapped environments
          • Configure
            • Apply configuration settings
            • Dynamic namespace handling
            • Configure the validating webhook
            • Restrict cross-namespace resource associations
            • Service meshes
              • Istio
              • Linkerd
            • Webhook namespace selectors
        • Manage deployments
          • Deploy an Elasticsearch cluster
          • Deploy a Kibana instance
          • Elastic Stack Helm chart
          • Applying updates
          • Accessing services
          • Configure deployments
            • Elasticsearch configuration
              • Nodes orchestration
              • Storage recommendations
              • Node configuration
              • Volume claim templates
              • Virtual memory
              • Settings managed by ECK
              • Update strategy
              • Pod disruption budget
              • Advanced Elasticsearch node scheduling
              • Readiness probe
              • Pod PreStop hook
              • Security context
              • Requests routing to Elasticsearch nodes
            • Kibana configuration
              • Connect to an Elasticsearch cluster
              • Advanced configuration
            • Customize pods
            • Propagate labels and annotations
            • Pause orchestration
            • Manage compute resources
            • Recipes
            • Connect to external Elastic resources
            • Elastic Stack configuration policies
        • Orchestrate other Elastic applications
          • APM server
            • Use an Elasticsearch cluster managed by ECK
            • Advanced configuration
            • Connect to the APM Server
          • Standalone Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
          • Fleet-managed Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
            • Known limitations
          • Elastic Maps Server
            • Deploy Elastic Maps Server
            • Map data
            • Advanced configuration
            • Elastic Maps HTTP configuration
          • Beats
            • Quickstart
            • Configuration
            • Configuration examples
            • Troubleshooting
          • Logstash
            • Quickstart
            • Configuration
            • Securing Logstash API
            • Logstash plugins
            • Configuration examples
            • Update strategy
            • Advanced configuration
          • Elastic Package Registry
        • Create custom images
        • Tools and APIs
      • Self-managed cluster
        • Install Elasticsearch
          • Local installation (quickstart)
          • Important system configuration
            • Elasticsearch service user requirements
            • Configuration methods
            • Disable swapping
            • Increase the file descriptor limit
            • Increase virtual memory
            • Increase max number of threads
            • Ensure JNA temporary directory permits executables
            • Decrease the TCP retransmission timeout
            • Synchronize system clocks
            • Bootstrap checks
          • Install on Linux or MacOS
          • Install on Windows
          • Install with Debian package
          • Install with RPM package
          • Install with Docker
            • Single-node cluster
            • Multi-node cluster
            • Production settings
            • Configure
        • Configure Elasticsearch
          • Important settings configuration
          • Add plugins
        • Install Kibana
          • Linux and MacOS
          • Windows
          • Debian
          • RPM
          • Docker
        • Configure Kibana
        • Access Kibana
        • Air gapped install
        • Tools and APIs
        • Tutorials
          • Install a self-managed Elastic Stack
          • Customize TLS certificates for a self-managed Elastic Stack
    • Distributed architecture
      • Clusters, nodes, and shards
        • Node roles
      • Reading and writing documents
      • Shard allocation, relocation, and recovery
        • Shard allocation awareness
        • Index-level shard allocation
          • Delaying allocation when a node leaves
      • The shard request cache
      • Discovery and cluster formation
        • Discovery
        • Quorum-based decision making
        • Voting configurations
        • Bootstrapping a cluster
        • Cluster state
        • Cluster fault detection
      • Kibana task management
    • Production guidance
      • Run Elasticsearch in production
        • Design for resilience
          • Resilience in small clusters
          • Resilience in larger clusters
          • Resilience in ECH and ECE
          • Resilience in Serverless
        • Scaling considerations
        • Performance optimizations
          • General recommendations
          • Tune for indexing speed
          • Tune for search speed
          • Tune approximate kNN search
          • Tune for disk usage
          • Size your shards
      • Run Kibana in production
        • High availability and load balancing
        • Configure memory
        • Manage background tasks
        • Traffic scaling considerations
        • Optimize alerting performance
        • Reporting production considerations
    • Reference architectures
      • Hot/Frozen - High Availability
      • GenAI Search - High Availability
    • Stack settings
    • Backup, high availability, and resilience tools
      • Snapshot and restore
        • Manage snapshot repositories
          • Self-managed
            • Azure repository
            • Google Cloud Storage repository
            • S3 repository
            • Shared file system repository
            • Read-only URL repository
            • Source-only repository
          • Elastic Cloud Hosted
            • AWS S3
            • Google Cloud Storage
            • Azure Blob Storage
            • Access isolation for the found-snapshots repository
              • Azure
              • AWS and GCP
          • Elastic Cloud Enterprise
            • AWS S3
            • Google Cloud Storage
            • Azure Storage repository
          • Elastic Cloud on Kubernetes
        • Create, monitor and delete snapshots
        • Restore a snapshot
          • Restore a snapshot across clusters
            • Restore snapshot into a new deployment
            • Restore snapshot into an existing deployment
            • Restore snapshots containing searchable snapshots indices across clusters
        • Searchable snapshots
          • Restore data to a regular index
      • Cross-cluster replication
        • Set up cross-cluster replication
          • Prerequisites
          • Connect to a remote cluster
          • Configure privileges for cross-cluster replication
          • Create a follower index to replicate a specific index
          • Create an auto-follow pattern to replicate time series indices
        • Manage cross-cluster replication
          • Inspect replication statistics
          • Pause and resume replication
          • Recreate a follower index
          • Terminate replication
        • Manage auto-follow patterns
          • Create auto-follow patterns
          • Retrieve auto-follow patterns
          • Pause and resume auto-follow patterns
          • Delete auto-follow patterns
        • Upgrading clusters
          • Uni-directional index following
          • Bi-directional index following
        • Uni-directional disaster recovery
          • Prerequisites
          • Failover when clusterA is down
          • Failback when clusterA comes back
        • Bi-directional disaster recovery
          • Initial setup
          • Failover when clusterA is down
          • Failback when clusterA comes back
          • Perform update or delete by query
    • Autoscaling
      • In ECE and ECH
      • In ECK
      • Autoscaling deciders
      • Trained model autoscaling
    • Plugins and custom configuration files
      • In ECH
        • Provided plugins
        • Custom plugins and bundles
        • Manage through API
      • In ECE
        • Provided plugins
        • Custom plugins and bundles
        • Additional Kibana plugins
      • In ECK
        • Init containers
        • ConfigMaps and Secrets
        • Kibana plugins
      • In self-managed
    • Cloud Connect
    • Security
      • Secure your orchestrator
        • Elastic Cloud Enterprise
          • Manage security certificates
          • Allow x509 Certificates Signed with SHA-1
          • Configure the TLS version
          • Migrate ECE on Podman hosts to SELinux enforce
        • Elastic Cloud on Kubernetes
      • Secure your cluster, deployment, or project
        • Self-managed security setup
          • Automatic security setup
          • Minimal security setup
          • Set up transport TLS
          • Set up HTTPS
          • Configure security in Kibana
        • Manage TLS encryption
          • Self-managed
            • Update TLS certificates
              • With the same CA
              • With a different CA
            • Mutual authentication
            • Supported SSL/TLS versions by JDK version
            • Enabling cipher suites for stronger encryption
          • ECK
            • Manage HTTP certificates on ECK
            • Manage transport certificates on ECK
            • Elasticsearch client certificate authentication
            • Fleet Server client certificate authentication
          • External CA for TLS
        • Network security
          • How network security policies work in Cloud
          • How IP filtering rules work in ECE
          • Add IP filters
            • In ECH or Serverless
            • In ECE
            • In ECK and Self Managed
          • Remote cluster filters
          • Private connectivity
            • AWS PrivateLink
            • Azure Private Link
            • GCP Private Service Connect
            • Claim private connection ownership
          • Through the API
          • Kubernetes network policies
        • Elastic Cloud Static IPs
        • Kibana session management
        • Encrypt your deployment data
          • Use a customer-managed encryption key
        • Secure your settings
          • Secure settings on ECK
        • Secure Kibana saved objects
      • Secure other Elastic Stack components
      • Securing HTTP client applications
      • Limitations
      • FIPS compliance
        • FIPS compliance for Elasticsearch
        • FIPS compliance for Kibana
        • FIPS mode for Ingest tools
    • Users and roles
      • Cloud organization
        • Manage users
        • User roles and privileges
        • Configure SAML SSO
          • Okta
          • Microsoft Entra ID
      • ECE orchestrator
        • Manage system passwords
        • Manage users and roles
          • Native users
          • Active Directory
          • LDAP
          • SAML
        • Configure SSO for deployments
      • Serverless project custom roles
      • Cluster or deployment
        • Quickstart
        • User authentication
          • Authentication realms
            • Realm chains
            • Security domains
          • Internal authentication
            • Native
            • File-based
          • External authentication
            • Active Directory
            • JWT
            • Kerberos
            • LDAP
            • OpenID Connect
              • With Azure, Google, or Okta
            • SAML
              • With Microsoft Entra ID
              • SAML attribute mapping
              • SAML signing and encryption
              • SAML without Kibana
            • PKI
            • Custom realms
          • Built-in users
            • Change passwords
          • Orchestrator-managed users
            • ECH and ECE
            • ECK managed credentials
          • Kibana authentication
          • Kibana access agreement
          • Anonymous access
          • Token-based authentication services
          • Service accounts
          • Internal users
          • Operator privileges
            • Configure operator privileges
            • Operator-only functionality
            • Operator privileges for snapshot and restore
          • User profiles
          • Looking up users without authentication
          • Controlling the user cache
          • Manage authentication for multiple clusters
        • User roles
          • Built-in roles
          • Defining roles
            • Role structure
            • For data streams and aliases
            • Using Kibana
            • Role restriction
          • Elasticsearch privileges
          • Kibana privileges
          • Map users and groups to roles
            • Role mapping properties
          • Authorization delegation
          • Authorization plugins
          • Control access at the document and field level
          • Submit requests on behalf of other users
    • Kibana Spaces
      • Select and switch Kibana spaces
      • Using Spaces with Fleet
    • API keys
      • Elasticsearch API keys
      • Serverless project API keys
      • Elastic Cloud API keys
      • Elastic Cloud Enterprise API keys
    • Application connections
      • OAuth for MCP clients
        • Create or edit an OAuth client
        • Connect an MCP host
        • Revoke or delete a client or connection
      • Manage application connections
    • Connectors
    • Remote clusters
      • Security models
      • Connection modes
      • On Elastic Cloud Hosted
        • To the same Elastic Cloud organization
        • To a different Elastic Cloud organization
        • To Elastic Cloud Enterprise
        • To a self-managed cluster
        • To Elastic Cloud on Kubernetes
        • Strong identity verification
        • Manage trusted environments
        • Migrate from the CCS deployment template
      • On Elastic Cloud Enterprise
        • To the same ECE environment
        • To a different ECE environment
        • To Elastic Cloud
        • To a self-managed cluster
        • To Elastic Cloud on Kubernetes
        • Manage trusted environments
        • Migrate from the CCS deployment template
      • On self-managed Elastic Stack
        • Add remote clusters using API key authentication
        • Add remote clusters using TLS certificate authentication
        • To Elastic Cloud on Kubernetes
        • Migrate from certificate to API key authentication
      • On Elastic Cloud on Kubernetes
        • To the same ECK environment
        • To a different ECK environment
        • To an external cluster or deployment
    • Cross-project search
      • Link and manage projects
      • Access and scope
    • Monitoring
      • AutoOps
        • For Elastic Cloud Hosted
        • For Elastic Cloud Serverless
          • Access AutoOps in your project
          • Search Tier view
          • Indexing Tier view
          • Storage Tier view
        • For ECE, ECK, and self-managed clusters
          • Connect your cluster
          • Metrics storage locations
          • Connect your local development cluster
          • Configure Elastic agent with custom certificate
          • Disable certain types of data collection
          • Manage connected cluster users
          • Troubleshooting
            • Run the Connectivity Check
            • Firewalls blocking Elastic Agent
            • Connected clusters not appearing with ECK
        • Regions
        • Views
          • Overview
          • Deployment or Cluster
          • Nodes
          • Indices
          • Shards
          • Template Optimizer
        • Events
          • Event settings
          • Notification settings
        • FAQ
      • Stack monitoring
        • Enable on ECH and ECE
        • Enable on ECK
        • Self-managed: Elasticsearch
          • Collecting monitoring data with Elastic Agent
          • Collecting monitoring data with Metricbeat
          • Collecting log data with Filebeat
          • Monitoring in a production environment
          • Legacy collection methods
            • Collectors
            • Exporters
            • Local exporters
            • HTTP exporters
            • Pausing data collection
        • Self-managed: Kibana
          • Collect monitoring data with Elastic Agent
          • Collect monitoring data with Metricbeat
          • Legacy collection methods
        • Access monitoring data in Kibana
        • Visualizing monitoring data
          • Beats metrics
          • Elasticsearch metrics
          • Kibana metrics
          • Integrations Server metrics
          • Logstash metrics
          • Troubleshooting
        • Stack monitoring alerts
        • Configuring monitoring data streams and indices
          • Configuring data streams created by Elastic Agent
          • Configuring data streams created by Metricbeat 8
          • Configuring indices created by Metricbeat 7 or internal collection
      • AutoOps vs. Stack Monitoring
      • Cloud deployment health
        • Performance metrics on Elastic Cloud
        • JVM memory pressure indicator
      • Query activity
      • Kibana task manager monitoring
      • Monitoring orchestrators
        • ECK operator metrics
          • Enabling the metrics endpoint
          • Securing the metrics endpoint
          • Prometheus requirements
        • ECE platform monitoring
          • Platform monitoring deployment logs and metrics
          • Proxy log fields
          • Set the retention period for logging and metrics indices
      • Activity logging
        • Query logging
        • Slow query and index logging
        • Stack audit logging
          • Enable audit logging
          • Configure audit logging
            • Elasticsearch audit events ignore policies
            • Elasticsearch logfile output
          • Audit HTTP request bodies
          • Correlate audit events
        • Elastic Cloud audit trail
        • Kibana user activity
        • Serverless log delivery
          • Serverless audit trail
      • Operational logging
        • Elasticsearch log4j configuration
        • Update Elasticsearch logging levels
        • Elasticsearch deprecation logs
        • Kibana logging
          • Set global log levels for Kibana
          • Advanced Kibana logging settings
            • Examples
    • Configure Kibana reporting
    • Customize Kibana branding
    • Manage your Cloud organization
      • Manage multiple organizations
      • Billing
        • Hosted billing dimensions
        • Serverless billing dimensions
          • Elasticsearch projects
          • Vector Database projects
          • Observability projects
          • Security projects
        • Billing models
        • Add your billing details
        • View your billing history
        • Manage budgets and notifications
        • Manage your subscription
        • Monitor and analyze usage
        • Elastic Consumption Units
        • Billing FAQ
      • Operational emails
      • Update billing and operational contacts
      • Service status
      • Tools and APIs
    • Licenses and subscriptions
      • Elastic Cloud Enterprise
      • Elastic Cloud on Kubernetes
      • Self-managed cluster
    • Maintenance
      • ECE maintenance
        • Deployments maintenance
          • Pause instance
        • Maintenance activities
          • Enable maintenance mode
          • Scale out your installation
          • Move nodes or instances from allocators
          • Perform ECE hosts maintenance
          • Delete ECE hosts
      • Start and stop services
        • Start and stop Elasticsearch
        • Start and stop Kibana
        • Restart an Elastic Cloud Hosted deployment
        • Restart an ECE deployment
        • Full Cluster restart and rolling restart procedures
      • Start and stop routing requests
      • Add and remove Elasticsearch nodes on self-managed clusters
    • Upgrade
      • Plan your upgrade
      • Preparation steps
        • Upgrade Assistant
      • Upgrade your deployment or cluster
        • Upgrade from 7.17 to 9.5.6
        • Upgrade on Elastic Cloud Hosted
        • Upgrade on Elastic Cloud Enterprise
        • Upgrade on Elastic Cloud on Kubernetes
        • Upgrade Elastic on a self-managed cluster
          • Upgrade Elasticsearch
          • Upgrade Elasticsearch running on Docker
          • Upgrade Kibana
            • Saved object migrations
            • Roll back to a previous version
        • Archived settings
        • Reading indices from older versions
        • Upgrade Enterprise Search
      • Upgrade your ingest components
      • Upgrade your ECE or ECK orchestrator
        • Upgrade Elastic Cloud Enterprise
          • Re-running the ECE upgrade
        • Upgrade Elastic Cloud on Kubernetes
    • Uninstall
      • Uninstall Elastic Cloud Enterprise
      • Uninstall Elastic Cloud on Kubernetes
      • Delete an orchestrated deployment
  • Solutions and use cases
    • Search use case
      • Get started
        • Quickstarts
          • Index and search basics
          • Keyword search with Python
          • Semantic search
      • Set up
        • Get Elasticsearch running
        • API key and endpoints
        • Connect with an SDK
      • Ingest for search use cases
        • Ingest pipelines for search use cases
      • Search approaches
        • Full-text search
          • How full-text search works
          • Text analysis during search
          • Query DSL intervals query
          • Search relevance optimizations
            • Mixing exact search with stemming
            • Getting consistent scoring
            • Incorporating static relevance signals into the score
          • Synonyms
            • Synonym set API examples
        • Vector search
          • Use cases
          • Semantic search for text
            • Semantic search with semantic_text
            • Semantic search with the inference API
            • Semantic search with ELSER (ingest pipelines)
            • Using Cohere with Elasticsearch
            • Tutorial: Manual dense and sparse workflows
            • Using OpenAI compatible models
          • Multimodal search
            • Tutorial: Build multimodal search
          • Dense vector
            • kNN search in Elasticsearch
              • Approximate kNN search
                • Filter approximate kNN results
                • Nested approximate kNN search
                • Approximate kNN query examples
                • Optimize performance and accuracy
              • Exact kNN search
            • Bring your own dense vectors
            • Optimize vector storage for semantic search
            • GPU vector indexing
          • Sparse vector search in Elasticsearch
        • Hybrid search
          • Hybrid search with semantic_text
        • Ranking and reranking
          • Semantic reranking
          • Learning To Rank (LTR)
            • Deploy and manage LTR models
            • Search using LTR
      • Build search queries
        • The _search API
        • The async-search API
        • ES|QL for search
        • Retrievers
        • Search templates
      • RAG
      • Add search to your app
        • Client libraries
        • Search UI
      • APIs and tools
    • Elasticsearch solution
      • Get started
        • AI onboarding
        • Find connection details
      • Agent Builder
      • Playground (deprecated)
        • Optimize model context
        • View and modify queries
        • Troubleshooting
      • Query rules UI
      • Search Applications
        • Search API and templates
        • Security
        • Search Application client guide
    • Vector Database project
      • Get started
      • Vector and full-text search
    • Observability solution
      • Get started
        • Elastic Observability quickstarts
          • Quickstart: Monitor hosts with OpenTelemetry
          • Quickstart: Monitor your application performance
          • Quickstart: Unified Kubernetes Observability with Elastic OpenTelemetry
          • Quickstart: Send OTLP data to Elastic Serverless or Elastic Cloud Hosted
          • Quickstart: Create a Synthetic Monitor
          • Quickstart: Monitor hosts with Elastic Agent
          • Quickstart: Monitor your Kubernetes cluster with Elastic Agent
          • Quickstart: Collect data with AWS Firehose
        • Start using OpenTelemetry
        • Switch to OpenTelemetry
        • OpenTelemetry quickstarts
          • Ingest custom metrics with Elastic OpenTelemetry
          • Self-managed
            • Kubernetes
            • Hosts / VMs
            • Docker
          • Elastic Cloud Serverless
            • Kubernetes
            • Hosts and VMs
            • Docker
          • Elastic Cloud Hosted
            • Kubernetes
            • Hosts and VMs
            • Docker
        • OpenTelemetry use cases
          • Kubernetes observability
            • Prerequisites and compatibility
            • Components description
            • Deployment
            • Instrumenting Applications
            • Upgrade
            • Customization
          • LLM observability
            • Claude Platform
          • Upstream OpenTelemetry Collector
        • Other Observability tutorials
          • Tutorial: Monitor a Java application
        • Logs Essentials
        • Observability Kibana privileges
      • Applications and services
        • Application performance monitoring (APM)
          • Get started with traces and APM
          • Application data types
            • Spans
            • Transactions
              • Transaction sampling
            • Traces
            • Errors
            • Metrics
            • Metadata
          • Collect application data
            • OpenTelemetry
              • Contrib OpenTelemetry Collectors and language SDKs
              • Collect metrics
              • Create APM agent key for EDOT SDKs
              • Centrally configure EDOT SDKs
              • Limitations
              • Attributes and labels
              • Data stream routing
            • APM agents
              • Centrally configure APM agents
              • Real User Monitoring (RUM)
              • Create and upload source maps (RUM)
            • Kubernetes
            • AWS Lambda Functions
            • Jaeger (deprecated)
          • View and analyze data
            • Overviews
              • Services
              • Traces UI
              • Dependencies
              • Service map in Elastic APM
              • Service overview
              • Mobile service overview
            • Drill down into data
              • Transactions UI
              • Trace sample timeline
              • Errors UI
              • Metrics UI
              • Infrastructure
              • Logs
            • Explore traces in Discover
            • Filter and search data
              • Filters
              • Advanced queries
              • Cross-cluster search
            • Interpret data
              • Find transaction latency and failure correlations
              • Track deployments with annotations
              • Explore mobile sessions with Discover
              • Observe Lambda functions
            • Integrate with Machine Learning
            • APM Agent explorer
          • Act on data
            • Create rules and alerts
            • Create custom links
          • Use APM securely
            • Secure data
              • Control access to APM data
              • Built-in data filters
              • Custom filters
              • Delete sensitive data
            • Secure communication with APM agents
              • APM agent TLS communication
              • API keys
              • Secret token
              • Anonymous authentication
            • Secure communication with the Elastic Stack
              • Use feature roles
              • Grant access using API keys
            • Secure access to the Applications UI
              • Create an APM reader user
              • Create an annotation user
              • Create an API user
              • Create a central config user
              • Create a storage explorer user
          • Manage storage
            • Storage Explorer
            • Data streams
            • Index lifecycle management
            • View the Elasticsearch index template
            • Parse data using ingest pipelines
            • Storage and sizing guide
            • Reduce storage
            • Explore data in Elasticsearch
          • Work with APM Server
            • Set up
              • Fleet-managed APM Server
              • APM Server binary
            • Configure
              • General configuration options
              • Anonymous authentication
              • APM agent authorization
              • Configure APM Agent Central Configuration
              • Instrumentation
              • Kibana endpoint
              • Logging
              • Output
                • Elastic Cloud Hosted
                • Elasticsearch
                • Logstash
                • Kafka
                • Redis
                • Console
              • Project paths
              • Real User Monitoring (RUM)
              • SSL/TLS settings
                • SSL/TLS output settings
                • SSL/TLS input settings
              • Tail-based sampling
              • Use environment variables in the configuration
              • Advanced setup
                • Installation layout
                • Secrets keystore
                • Command reference
                • Tune data ingestion
                • High Availability
                • APM Server and systemd
            • Monitor
              • Fleet-managed
              • APM Server binary
                • Use internal collection
                • Use Metricbeat collection
                • Use local collection
          • APM APIs
            • APM UI API
            • APM Server API
              • APM Server information API
              • Elastic APM events intake API
              • Elastic APM agent configuration API
              • OpenTelemetry intake API
              • Jaeger event intake
            • Managed inputs APM intake event API
          • Upgrade
            • APM agent compatibility
            • Upgrade to version 9.0
              • Self-installation standalone
              • Self-installation APM integration
              • Elastic Cloud standalone
              • Elastic Cloud APM integration
            • Switch to the Elastic APM integration
              • Switch a self-installation
              • Switch an Elastic Cloud cluster
        • Synthetic monitoring
          • Get started
            • Use a Synthetics project
            • Use the Synthetics UI
          • Scripting browser monitors
            • Write a synthetic test
            • Configure individual monitors
            • Use the Synthetics Recorder
          • Configure lightweight monitors
          • Manage monitors
          • Work with params and secrets
          • Analyze monitor data
          • Monitor resources on private networks
          • Use the CLI
          • Configure a Synthetics project
          • Multi-factor Authentication
          • Kerberos authentication
          • Configure Synthetics settings
          • Grant users access to secured resources
            • Setup role
            • Writer role
            • Reader role
          • Manage data retention
          • Use Synthetics with network security
          • Migrate from the Elastic Synthetics integration
          • Scale and architect a deployment
          • Synthetics support matrix
          • Synthetics Encryption and Security
        • Real user monitoring
          • OpenTelemetry for Real User Monitoring (RUM)
        • LLM and agentic AI observability
        • Uptime monitoring (deprecated)
          • Get started
          • Analyze
            • View monitor status
            • Analyze monitors
            • Inspect uptime duration anomalies
          • Configure settings
        • Visualize OpenTelemetry data
      • CI/CD
      • Cloud
        • AWS
          • Ingestion options
          • Monitor AWS with Elastic Agent
            • EC2
            • Kinesis data streams
            • S3
            • SQS
          • Monitor AWS with Beats
          • Monitor AWS with Amazon Data Firehose
            • VPC Flow Logs
            • CloudTrail logs
            • Network Firewall logs
            • WAF logs
            • CloudWatch logs
          • Monitor AWS with Elastic Serverless Forwarder
        • Azure
          • Monitor Microsoft Azure with Elastic Agent
          • Monitor Microsoft Azure with Beats
          • Ingest multi-tenant Azure Event Hub logs with Filebeat
          • Monitor Microsoft Azure with the Azure Native Service
          • Monitor Microsoft Azure OpenAI
        • GCP
          • GCP Dataflow templates
      • Infrastructure and hosts
        • Analyze infrastructure and host metrics
          • Get started with system metrics
          • View infrastructure metrics by resource type
          • Explore metrics data with Discover in Kibana
          • Explore infrastructure metrics over time (deprecated)
          • Analyze and compare hosts
          • Detect metric anomalies
          • Configure settings
        • Universal Profiling
          • Get started
          • Manage data storage
            • Index lifecycle management
            • Configure probabilistic profiling
          • Advanced configuration
            • Tag data for querying
            • Add symbols for native frames
            • Use a proxy
            • Override kernel version check
            • Environment variables to configure the Universal Profiling Agent
            • Configuration file of the Universal Profiling Agent
          • Upgrade
          • Self-hosted infrastructure
          • Install the backend
            • Step 1: Update the stack
            • Step 2: Enable Universal Profiling in Kibana
            • Step 3: Set up Universal Profiling in Kibana
            • Step 4: Run the backend applications
            • Step 5: Next steps
          • Operate the backend
        • Network Topology
          • Tutorial: Monitor your network devices with the Network Topology plugin
          • Network Topology field reference
        • Tutorial: Observe your Kubernetes deployments
        • Tutorial: Observe your nginx instances
          • Understanding "no results found" message
        • Collect NGINX data with OpenTelemetry integrations (Fleet-managed)
        • Collect NGINX data with OpenTelemetry integrations (standalone)
      • Logs
        • Get started with system logs
        • Send any log file using Elastic Agent
        • Send any log file using OTel Collector
        • Send application log data
          • Plaintext application logs
          • ECS formatted application logs
          • APM agent log sending
        • Parse and route logs using ingest pipelines
        • Filter and aggregate logs
        • Explore logs
          • Explore logs in Discover
          • Categorize log entries
          • Inspect log anomalies
        • Run a pattern analysis on log data
        • Configure log data sources
        • Configure log data retention
        • Add a service name to logs
        • Logs index template reference
          • Default logs index template
      • Metrics
        • Get started
        • Plan your setup
        • Ingest metrics
        • Migrate to Elastic
          • Migrate from Prometheus
          • Migrate from Datadog
        • Explore metrics
        • Manage storage
      • Streams
        • Get data into Streams
        • Organize data
        • Process documents
        • Configure data lifecycle
        • Manage data quality
        • Map fields
        • Configure advanced settings
        • Knowledge Indicators
        • Wired streams field naming
        • Streamlang
          • Append processor
          • Concat processor
          • Convert processor
          • Date processor
          • Dissect processor
          • Drop document processor
          • Enrich processor
          • Grok processor
          • Join processor
          • JSON extract processor
          • Lowercase processor
          • Math processor
          • Network direction processor
          • Redact processor
          • Registered domain processor
          • Remove processor
          • Rename processor
          • Replace processor
          • Set processor
          • Sort processor
          • Split processor
          • Trim processor
          • Uppercase processor
          • URI parts processor
          • User agent processor
          • Manual pipeline configuration
      • Incident management
        • Alerting
          • Create and manage rules
            • Anomaly detection
            • APM anomaly
            • Custom threshold
            • Degraded docs
            • Elasticsearch query
            • Error count threshold
            • Failed transaction rate threshold
            • Failed docs
            • Inventory
            • Latency threshold
            • Log threshold
            • Metric threshold
            • Monitor Status
            • TLS certificate
            • Uptime duration anomaly
            • SLO burn rate
          • Aggregation options
            • Rate aggregation
          • View and manage alerts
            • SLO burn rate breaches
            • Threshold breaches
        • Cases
        • Service-level objectives (SLOs)
          • Configure SLO access
          • Create an SLO
          • Create a composite SLO
          • View and manage SLOs
          • Configure SLOs settings
      • Data set quality
      • AI for Observability
        • Agent Builder for Observability
        • AI Assistant
        • Automatic Import
        • LLM performance matrix
      • Cross-project search
      • Serverless feature tiers
      • APIs
    • Security solution
      • Get started
        • Elastic Security quickstarts
          • Detect and respond to threats with SIEM
          • Protect your hosts with endpoint security
          • Secure your cloud assets with cloud security posture management
        • Elastic Security requirements
        • Elastic Security UI
        • Serverless feature tiers
      • Migrate
      • Set up
        • Configure endpoint protection with Elastic Defend
          • Elastic Defend requirements
          • Install Elastic Defend
            • Enable access on macOS
            • Deploy on macOS with MDM
          • Configure offline endpoints and air-gapped environments
          • Remote output and cross-cluster search
        • Set up cloud security
          • Get started with CSPM for AWS
          • Get started with CSPM for GCP
          • Get started with CSPM for Azure
          • CSPM privilege requirements
          • Get started with KSPM
          • Set up Cloud Asset Discovery for AWS
          • Set up Cloud Asset Discovery for GCP
          • Set up Cloud Asset Discovery for Azure
          • Get started with CNVM
          • CNVM privilege requirements
          • Enable cloud security features in Serverless
        • Get started with Defend for Containers for Kubernetes
        • Set up AI features
          • Large language model performance matrix for Elastic Security
        • Entity analytics requirements
        • Machine learning job and rule requirements
      • Ingest data
        • Integrations that power Findings and Alerts
          • AWS Config
          • AWS Inspector
          • AWS Security Hub
          • AWS Security Hub CSPM
          • CNCF Falco
          • Google Security Command Center
          • Microsoft Defender for Cloud
          • Microsoft Defender for Endpoint
          • Microsoft Defender XDR
          • Prisma Cloud
          • Qualys VMDR
          • Rapid7 InsightVM
          • Tenable VM
          • Wiz
        • Use Automatic Import for custom integrations
        • Threat intel integrations
      • Manage
        • Manage Elastic Defend
          • Endpoints
          • Policies
          • Configure an integration policy for Elastic Defend
            • Configure updates for protection artifacts
            • Turn off diagnostic data for Elastic Defend
            • Configure self-healing rollback for Windows endpoints
            • Configure Linux file system monitoring
            • Configure data volume
            • Create an Elastic Defend policy using API
          • Endpoint artifacts
            • Optimize Elastic Defend
            • Elastic Endpoint exceptions
            • Trusted applications
            • Trusted devices
            • Event filters
            • Host isolation exceptions
            • Blocklist
            • Exception types and syntax
          • Endpoint protection rules
          • Elastic Endpoint self-protection features
          • Allowlist Elastic Endpoint in third-party antivirus apps
          • Event capture and Elastic Defend
          • Automatic troubleshooting
          • Prevent Elastic Agent uninstallation
          • Uninstall Elastic Agent
        • Manage cloud workload protection
          • Cloud workload protection for VMs
            • Capture environment variables
          • Cloud workload protection for Kubernetes
            • Container workload protection policies
            • Kubernetes dashboard
        • Access control
          • Security Kibana privileges
          • Elastic Defend sub-feature privileges
          • Detections privileges
          • Attack Discovery privileges
        • Configure workspace settings
          • Spaces and Elastic Security
            • Spaces and Elastic Defend FAQ
          • Data views and Elastic Security
          • Create runtime fields in Elastic Security
      • AI-assisted operations
        • Agent Builder for Elastic Security
          • Agents, skills, and tools
          • Security use cases
        • Attack Discovery
          • Run Attack Discovery
            • Run from Attacks view
              • Configure Attack Discovery settings
              • Manual runs
              • Scheduled runs
              • Troubleshoot with AI
            • Run from a workflow
            • Run from Agent Builder
            • Run from Attack Discovery page
          • Triage Attack Discovery findings
          • Review and triage discoveries
            • Manage from Attacks view
            • Manage from Attack Discovery page
        • AI use cases
          • Triage alerts with AI Assistant
          • Identify, investigate, and document threats
          • Generate, customize, and learn about ES|QL queries
        • AI Assistant for Security
        • Security MCP App
        • AI Assistant Knowledge Base
          • Content connectors
          • Use AI Assistant's Knowledge Base to improve response quality
        • Value report
        • Elastic AI SOC Engine
          • Triage alerts in Elastic AI SOC Engine
          • Upgrade from EASE to Elastic Security
      • Detect and analyze
        • Before you begin
          • Turn on detections
          • Detection rule concepts
        • MITRE ATT&CK coverage
          • Remap to MITRE ATT&CK v19
        • Prebuilt rules
          • Prebuilt rule components
          • Install prebuilt rules
          • Update prebuilt rules
          • Prebuilt rules in air-gapped environments
          • Customize prebuilt rules
        • Author rules
          • Choose the right rule type
            • About building block rules
          • Rule type guides
            • ES|QL rules
            • Custom query rules
            • Event correlation (EQL) rules
            • Indicator match rules
            • Threshold rules
            • Machine learning rules
            • New terms rules
          • Using the UI
          • Using the API
          • Common rule settings
          • Set rule data sources
          • Write investigation guides
          • Validate and test rules
        • Advanced data source configuration
          • Cross-cluster search and detection rules
          • Cross-project search and detection rules
          • Using logsdb index mode with Elastic Security
        • Manage detection rules
          • View rule changes history
        • Monitor rule executions
          • Fill rule execution gaps
        • Reduce noise and false positives
          • Tune detection rules
          • Rule exceptions
            • Create and manage value lists
            • Add and manage exceptions
            • Create and manage shared exception lists
          • Suppress detection alerts
      • Respond and contain
        • Triage detection alerts
          • Visualize detection alerts
          • View detection alert details
          • Query alert indices
        • Endpoint response actions
          • Automated response actions
          • Isolate a host
          • Response actions history
          • Script library
          • Third-party response actions
          • Configure third-party response actions
      • Hunt and assess posture
        • Dashboards
          • Overview dashboard
          • Detection & Response dashboard
          • Cloud Security Posture dashboard
          • Kubernetes dashboard
          • Entity Analytics dashboard
          • Data Quality dashboard
          • Cloud Native Vulnerability Management dashboard
          • Detection rule monitoring dashboard
          • Endpoint Detection and Response dashboard
        • Cloud Security
          • Security posture management overview
          • Cloud security posture management
            • CSPM Findings
            • CSPM benchmarks
            • Cloud Security Posture dashboard
            • Frequently asked questions (FAQ)
          • Kubernetes security posture management
            • KSPM Findings
            • KSPM benchmarks
            • Cloud Security Posture dashboard
            • Frequently asked questions (FAQ)
          • Cloud Asset Discovery
          • Cloud native vulnerability management
            • CNVM Findings
            • CNVM dashboard
            • Frequently asked questions (FAQ)
        • Entity analytics
          • Entity store
            • Entity relationships
          • Entity risk scoring
            • Turn on risk scoring
            • Asset criticality
            • View and analyze risk score data
          • Manage entities
            • Watchlists
            • Entity resolution
            • Privileged user monitoring
              • Privileged user monitoring requirements
              • Set up privileged user monitoring
              • Monitor privileged user activities
          • Advanced behavioral detections
            • Anomaly detection
            • Optimizing anomaly results
            • Behavioral detection use cases
          • Review entity risk
            • Monitor entity risk
            • View entity details
      • Investigate
        • Explore Security data in Discover
        • Timeline
          • Timeline templates
        • Visual event analyzer
        • Session View
        • Osquery
          • Osquery manager integration
          • Osquery FAQ
          • Add Osquery Response Actions
          • Run Osquery from investigation guides
          • Run Osquery from alerts
          • Examine Osquery results
          • Use placeholder fields in Osquery queries
        • Notes
        • Indicators of compromise
        • Cases
        • ES|QL for security
          • Tutorial: Threat hunting with ES|QL
        • Explore
          • Hosts page
          • Network page
            • Configure network map data
            • Configure the DNS histogram
          • Users page
      • APIs
  • Manage data
    • The Elasticsearch data store
      • Index fundamentals
      • Near real-time search
      • Data streams
        • Set up a data stream
        • Use a data stream
        • Modify a data stream
        • Manage a data stream in Kibana
        • Time series data streams
          • Quickstart
          • Set up a TSDS
          • Downsampling
            • Concepts
            • Configuration
            • Querying
          • Advanced topics
            • Time-bound indices
            • Load historical data
            • Metric temporality
            • Reindex a TSDS
            • OTLP/HTTP endpoint
            • Prometheus remote write endpoint
        • Logs data streams
          • Configure a logs data stream
          • Enable logsdb for integrations
        • Failure store
          • Using failure stores to address ingestion issues
      • Columnar storage
      • Mapping
        • Dynamic mapping
          • Dynamic field mapping
          • Dynamic templates
        • Explicit mapping
        • Runtime fields
          • Map a runtime field
          • Define runtime fields in a search request
          • Override field values at query time
          • Retrieve a runtime field
          • Index a runtime field
          • Explore your data with runtime fields
        • Removal of mapping types
        • Update mapping API examples
      • Text analysis
        • Concepts
          • Anatomy of an analyzer
          • Index and search analysis
          • Stemming
          • Token graphs
        • Configure text analysis
          • Test an analyzer
          • Configuring built-in analyzers
          • Create a custom analyzer
          • Specify an analyzer
      • Templates
        • Simulate multi-component templates
        • Ignore missing component templates
      • Aliases
      • Manage indices in Kibana
        • Index operations reference
      • Manage data using APIs
    • Ingest: Bring your data to Elastic
      • Ingesting time series data
      • Ingesting data for Elastic solutions
      • Ingesting data from applications
        • Ingest data with Node.js
        • Ingest data with Python
        • Ingest data from Beats with Logstash as a proxy
        • Ingest data from a relational database
        • Ingest logs from a Python application using Filebeat
        • Ingest logs from a Node.js web application using Filebeat
      • Ingest architectures
        • Elastic Agent to Elasticsearch
          • Elastic Agent to Elasticsearch: Agent installed
          • Elastic Agent to Elasticsearch: APIs for collection
        • Elastic Agent to Logstash to Elasticsearch
          • Elastic Agent to Logstash (for enrichment) to Elasticsearch
          • Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering
          • Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy
          • Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations
        • Elastic Agent to proxy to Elasticsearch
        • Elastic Agent to Elasticsearch with Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Logstash to Elasticsearch: Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Kafka ES Sink to Elasticsearch: Kafka as middleware message queue
        • Logstash to Elasticsearch
        • Elastic air-gapped architectures
          • Elastic Agent to Elasticsearch: Air-gapped environment
          • Elastic Agent to Logstash: Air-gapped environment
      • Elastic Managed integrations
        • Enable an Elastic Managed integration
        • Federated identity authentication
        • FAQ
      • OTLP/HTTP endpoint
      • Sample data
      • Upload data files
      • Transform and enrich data
        • Calculate the ingest lag metadata
        • Elasticsearch ingest pipelines
          • Example
          • Create readable and maintainable ingest pipelines
          • Error handling
        • Logstash pipelines
        • Split an event into multiple documents
        • Data enrichment
          • Set up an enrich processor
          • Example: Enrich your data based on geolocation
          • Example: Enrich your data based on exact values
          • Example: Enrich your data by matching a value to a range
        • Index mapping and text analysis
      • Ingest tools overview
    • Data lifecycle
      • Data tiers
        • Manage data tiers in ECH or ECE
        • Manage data tiers in self-managed and ECK
      • Index lifecycle management
        • ILM phases and actions
        • Index rollover and routing allocation
          • Skip rollover
        • Create an ILM policy
        • Apply a policy to an existing index
        • Check the ILM status of indices and data streams
        • Manage the lifecycle policy for integrations data
        • Update or switch an index lifecycle policy
        • Start and stop ILM
        • Restore managed indices and manage ILM actions
        • ILM automation tutorials
          • Manage time series data with data streams
          • Manage time series data without data streams
          • Manage general content with data streams
          • Customize built-in ILM policies
        • Migrate to ILM
          • Migrate to ILM (ECH or ECE)
          • Migrate to ILM (self-managed and ECK)
          • Migrate index allocation filters to ILM node roles
      • Data stream lifecycle
        • Creating a data stream with a lifecycle
        • Update the lifecycle of a data stream
        • Setting retention for Elasticsearch data streams
        • Searchable snapshots
        • Migrating ILM-managed data streams to data stream lifecycle
      • Curator
      • Rollup
        • Get started using the API
        • Get started in Kibana
        • Rollup groups and configuration
        • Rollup aggregation limitations
        • Rollup search limitations
        • Migrating to downsampling
    • Migrate your Elasticsearch data
      • Migrate data using snapshots
      • Migrate data using the reindex API
        • Reindex using a private CA
      • Migrate data using Logstash
      • Migrate system indices
    • Use case: Use Elasticsearch to manage time series data
  • Explore and analyze
    • Learn data exploration and visualization
    • Querying and filtering
      • Query languages
        • Query DSL
        • ES|QL
        • SQL
        • EQL
          • Example: Detect threats with EQL
        • KQL
        • Lucene query syntax
      • Query tools
        • Saved queries
        • Console
        • Search profiler
        • Grok debugger
      • Aggregations
        • Basics
      • Filtering in Kibana
    • Geospatial analysis
    • Transforming data
      • Overview
      • Setup
      • When to use transforms
      • Generating alerts for transforms
      • Transforms at scale
      • How checkpoints work
      • API quick reference
      • Tutorial: Transforming the eCommerce sample data
      • Examples
      • Painless examples
      • Limitations
    • Elastic Inference
      • Elastic Inference Service (EIS)
        • Supported models
        • Region and hosting
        • Rate limits
        • EIS for Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed clusters
      • External inference
        • Trust a private CA
      • Default endpoints, adaptive allocations, and chunking
    • Machine learning
      • Setup and security
      • Anomaly detection
        • Finding anomalies
          • Plan your analysis
          • Run a job
          • View the results
          • Forecast future behavior
        • Tutorial
        • Advanced concepts
          • Anomaly detection algorithms
          • Anomaly score explanation
          • Job types
          • Working with anomaly detection at scale
          • Handling delayed data
          • Daylight saving time calendars
        • API quick reference
        • How-tos
          • Generating alerts for anomaly detection jobs
          • Aggregating data for faster performance
          • Altering data in your datafeed with runtime fields
          • Customizing detectors with custom rules
          • Detecting anomalous categories of data
          • Performing population analysis
          • Reverting to a model snapshot
          • Detecting anomalous locations in geographic data
          • Mapping anomalies by location
          • Adding custom URLs to machine learning results
          • Anomaly detection jobs from visualizations
        • Resources
          • Limitations
          • Analysis function reference
          • Supplied configurations
          • Troubleshooting and FAQ
      • Data frame analytics
        • Overview
        • Finding outliers
        • Predicting numerical values with regression
        • Predicting classes with classification
        • Advanced concepts
          • How data frame analytics analytics jobs work
          • Working with data frame analytics at scale
          • Adding custom URLs to data frame analytics jobs
          • Feature encoding
          • Feature processors
          • Feature importance
          • Loss functions for regression analyses
          • Hyperparameter optimization
          • Trained models
        • API quick reference
        • Resources
          • Limitations
      • NLP
        • Overview
          • Extract information
          • Classify text
          • Search and compare text
        • Deploy trained models
          • Select a trained model
          • Import the trained model and vocabulary
          • Deploy the model in your cluster
          • Try it out
        • Add NLP inference to ingest pipelines
        • API quick reference
        • Built-in NLP models
          • ELSER
          • Jina
          • Elastic Rerank
          • E5
          • Language identification
        • Compatible third party models
        • Examples
          • End-to-end tutorial
          • Named entity recognition
          • Text embedding and semantic search
        • Limitations
      • ML in Kibana
        • AIOps Labs
        • Inference processing
    • Scripting
      • Painless
        • How to write Painless scripts
          • Write your first script
          • Use parameters
          • Shorten scripts
          • Store and retrieve scripts
          • Update documents using scripts
        • Painless script tutorials
          • Accessing document fields and special variables
          • Accessing fields in a document
          • Converting data types
          • Dissecting data
          • Extracting fields
          • Grokking grok
          • Scripts, caching, and search speed
          • Updating documents
          • Using Painless regular expressions
          • Working with dates
        • Painless syntax-context bridge
        • Scripting and security in Painless
        • Painless lab
        • Debugging Painless scripts
          • Array manipulation errors
          • Date math errors
          • Field not found errors
          • Ingest pipeline failures
          • Null pointer exceptions
          • Regex pattern matching failures
          • Runtime field exceptions
          • Sandbox limitations
          • Script score calculation errors
          • Subfield access
          • Type casting issues
      • Lucene expressions language
      • Implementing custom scripting language in Elasticsearch
    • Cross-cluster search
      • Resolve a cluster before cross-cluster search
    • Cross-project search
      • Search
      • Tags
      • Project routing
      • CPS scope in project apps
      • Compare with CCS
      • CPS in ES|QL
    • AI-powered features
      • Automatic Import
      • Agent Builder
        • Get started
        • Models
        • Chat
          • Chat UI modes
          • Dashboards and visualizations
          • Discover tables
        • Agents
          • Custom agents
          • Built-in agents
          • Prompting best practices
          • Connect agents and workflows
        • Skills
          • Built-in skills
          • Custom skills
          • Skill creation guidelines
        • Plugins
        • Tools
          • Built-in tools
          • Custom tools
            • ES|QL tools
            • Index search tools
            • MCP tools
            • Workflow tools
        • Connectors
        • Programmatic access
          • Kibana APIs
            • Kibana API tutorial
          • A2A server
          • MCP server
            • API key authentication
            • OAuth authentication
        • Monitor usage and costs
          • Collect agent traces
          • Overview dashboard
          • Create alerts on trace data
        • Permissions
          • Create API keys
        • Troubleshooting
          • Context length exceeded
          • 403 Forbidden
          • Disabled pre-execution workflow
        • Limitations
        • Glossary
      • AI chat experiences
        • Compare Agent Builder and AI Assistant
        • AI assistants
        • Knowledge base artifact repo for AI Assistant
      • Manage access to AI features
      • AI agent skills
      • Elastic Claude plugin
      • Elastic Serverless Claude connector
      • Configure access to LLMs
        • Connect to Azure OpenAI
        • Connect to Amazon Bedrock
        • Connect to OpenAI
        • Connect to Google Vertex
        • Self-managed custom LLMs
          • Connect to LM Studio for Observability
          • Connect to LM Studio for Elastic Security
          • Connect to vLLM for Elastic Security
    • Discover
      • Explore fields and data with Discover
      • Switch query mode
      • Use Discover with ES|QL
        • Get started with ES|QL
        • Browse data sources
        • Work with results
        • Add variable controls
        • Create lookup indices
        • Inspect grouped STATS
        • Detect change points
      • Customize the Discover view
      • Search for relevance
      • Save a Discover session for reuse
      • View field statistics
      • Run a pattern analysis on your log data
      • Run queries in the background
    • Dashboards
      • Inspect and filter a dashboard
      • Ways to build a dashboard
        • Create from the UI
        • Create programmatically
        • Create using AI
        • Enhance using AI
        • Edit a dashboard
        • Drilldowns
          • Create a dashboard drilldown
          • Create a URL drilldown
          • Create a Discover drilldown
          • Manage drilldowns
        • Organize dashboard panels
        • Duplicate a dashboard
      • Managing dashboards
        • Export and share dashboards
        • Import a dashboard
        • Manage as code
      • Tutorials
        • Create a simple dashboard to monitor website logs
        • Create a dashboard with time series charts
    • Panels and visualizations
      • Visualizations
        • Area charts
        • Bar charts
        • Heat map charts
        • Gauge charts
        • Line charts
        • Metric charts
        • Mosaic charts
        • Pie charts
        • Region map charts
        • Tables
        • Waffle charts
        • Tag cloud charts
        • Treemap charts
      • Visualizations (ES|QL query)
      • Custom visualizations with Vega
      • Custom panels
        • Examples
      • Text panels
      • Image panels
      • Link panels
      • Alert panels
      • Controls
        • Add controls
        • Add time slider controls
        • Add variable controls
        • Control settings
      • Canvas
        • Edit workpads
        • Present your workpad
        • Tutorial: Create a workpad for monitoring sales
        • Canvas function reference
          • TinyMath functions
      • Maps
        • Build a map to compare metrics by country or region
        • Track, visualize, and alert on assets in real time
        • Map custom regions with reverse geocoding
        • Heat map layer
        • Tile layer
        • Vector layer
          • Vector styling
          • Vector style properties
          • Vector tooltips
        • Plot big data
          • Clusters
          • Display the most relevant documents per entity
          • Point to point
          • Term join
        • Search geographic data
          • Create filters from a map
          • Filter a single layer
          • Search across multiple indices
        • Configure map settings
        • Connect to Elastic Maps Service
        • Import geospatial data
          • Clean your data
          • Tutorial: Index GeoJSON data
        • Troubleshoot
      • Graph
        • Configure Graph
        • Troubleshooting and limitations
      • Legacy editors
        • Aggregation-based
        • TSVB
        • Timelion
      • Visualize library
    • Find and organize content
      • The Kibana interface
      • Data views
        • Create a data view
        • Delete a data view
        • Duplicate a data view
        • Customize data view fields
          • Explore your data with runtime fields
          • Scripted fields
          • Format data view fields
          • Data view field cache
      • Saved objects
      • Files
      • Reports
      • Tags
      • Find apps and objects
      • Personal preferences
        • Use dark mode in Kibana
        • Use high-contrast mode in Kibana
        • Change the interface language in Kibana
        • Customize your navigation menu
    • Reporting and sharing
      • Automatically generate reports
      • Troubleshoot reporting
        • CSV
        • PDF/PNG
    • Alerting
      • Compare alerting systems
      • Kibana Universal Alerting
        • Get started
          • How it works
          • Glossary
          • Create your first rule
        • Set up
        • Manage
          • Configure access
          • Authorization
        • Rules
          • Create a rule
            • Create an ES|QL rule
              • YAML rule schema reference
            • Create rules using Agent Builder
            • Create rules using the rule builder
            • Create from Discover
          • Configure a rule
            • Rule mode
            • ES|QL query
            • Schedule and lookback
            • Severity
            • Grouping
            • Alert delay
            • Recovery condition
            • No-data handling
            • Tags, runbooks, and dashboards
          • View and manage rules
          • Review rule execution history
          • Review rule change history
          • ES|QL query patterns
            • Your first rule query
            • Threshold queries
            • No-data detection
            • SLO burn rate
            • Persistent breach detection
          • Rule events
        • Alerts
          • How Kibana stores rule events
          • View and manage alerts
            • Triage alerts
            • Investigate alerts
          • Query alert history
          • Query rule events
          • Field reference
        • Notifications and actions
          • Connect workflows
          • About action policies
          • Examples and common scenarios
            • Route by severity
            • Severity escalation
            • Re-notification
          • Create an action policy
          • Action policy reference
          • Manage action policies
          • Review action policy execution history
          • Reduce notification noise
      • Kibana Classic Alerting
        • Getting started with alerts
        • Set up
        • Rules and Elastic Cloud API keys in Serverless
        • Create and manage rules
        • View and manage alerts
        • Query alert indices
        • Rule types
          • Index threshold
          • Elasticsearch query
          • Tracking containment
        • Rule action variables
        • Notifications domain allowlist
        • Troubleshooting and limitations
          • Common issues
          • Troubleshoot rule behavior
          • Event log index
          • Test connectors
        • Maintenance windows
      • Watcher
        • Getting started with Watcher
        • How Watcher works
        • Enable Watcher
        • Watcher UI
        • Encrypting sensitive data in Watcher
        • Inputs
          • Simple input
          • Search input
          • HTTP input
          • Chain input
        • Triggers
          • Schedule trigger
          • Throttling
          • Schedule Types
        • Conditions
          • Always condition
          • Never condition
          • Compare condition
          • Array compare condition
          • Script condition
        • Actions
          • Running an action for each element in an array
          • Adding conditions to actions
          • Email action
          • Webhook action
          • Index action
          • Logging action
          • Slack action
          • PagerDuty action
          • Jira action
        • Transforms
          • Search payload transform
          • Script payload transform
          • Chain payload transform
        • Managing watches
        • Example watches
          • Watching the status of an Elasticsearch cluster
          • Execute a watch
        • Limitations
    • Cases
      • Control access
      • Create cases
      • Manage cases
      • Analyze with AI
      • Attach objects
      • Search and share
      • Configure settings
      • Case templates
        • Create field library fields
        • Create templates
        • Edit and share templates
        • YAML schema reference
      • Case analytics
        • Indices
        • Explore and visualize
        • Query with ES|QL
        • Analyze fields
        • Field reference
        • Administer
    • Workflows
      • Get started
        • Set up Workflows
        • Build your first workflow
      • Use cases
        • Security
          • Automate security operations
            • Alert analysis workflow
            • Triage alerts into cases
            • AI-driven alert triage
            • Enrich with threat intel
          • Manage detection rules at scale
            • Run rules on demand
        • Observability
          • Root cause analysis
        • AI-augmented workflows
          • Classify and route alerts
      • Concepts
        • Managed workflows
        • Authorization
        • Triggers
          • Manual triggers
          • Scheduled triggers
          • Alert triggers
          • Event-driven triggers
        • Steps
          • Action steps
            • Elasticsearch
            • Kibana
            • Cases
            • Entity store
            • Security
              • Detection rules
              • Alert triage
              • Attack triage
            • Streams
            • External systems and apps
          • Flow control
            • If
            • Foreach
            • While
            • Switch
            • Parallel
            • Wait
            • Wait for input
            • Wait for approval
            • Loop break
            • Loop continue
          • AI
          • Data
          • Composition
        • Templating engine
        • Reference
          • Cheat sheet
          • Context variables
          • Glossary
          • Liquid filters
          • Step type index
      • Workflow authoring techniques
        • Use natural language
        • Use the YAML editor
        • Anatomy of a workflow
        • Workflow settings
        • Choose the right step
        • Pass data and handle errors
        • Compose workflows
        • Human-in-the-loop
        • Monitor workflow execution
        • Manage and organize workflows
        • Troubleshooting
        • Migrate workflows from 9.3 to 9.4
      • Workflow templates
        • Start from a template
    • Numeral formatting
  • Manage your Cloud account and preferences
    • Join or leave an organization
    • Update your email address
    • Change your password
    • Add a login method
    • Multifactor authentication
    • View and switch between organizations
  • Troubleshoot
    • Elasticsearch
      • Clusters
        • Common cluster issues
          • Watermark errors
          • Circuit breaker errors
          • High CPU usage
          • High JVM memory pressure
          • Red or yellow health status
          • Rejected requests
          • Task queue backlog
          • Mapping explosion
          • Hot spotting
        • Unstable clusters
        • Unbalanced clusters
        • Remote clusters
        • Unassigned shards
        • Shard capacity issues
        • Cluster allocation API examples
      • Data
        • Data allocation
        • Index allocation
        • Preferred data tier
        • Incomplete migration to data tiers
        • Not enough nodes to allocate shard replicas
        • Total number of shards for an index exceeded
        • Total number of shards per node reached
        • Data corruption
        • Ingest Pipelines
        • Timestamp data quality
      • Capacity
        • Data nodes out of disk
          • Increase disk capacity
          • Decrease disk usage
        • Master nodes out of disk
        • Other nodes out of disk
      • Snapshot and restore
        • Restore from snapshot
        • Broken repositories
          • Corrupted repositories
          • Unknown repositories
          • Invalid repositories
        • Snapshot policy failures
      • Searches
      • Data lifecycle
        • Snapshot and index lifecycle management
        • Index lifecycle management errors
        • Data stream lifecycle transitions
      • File-based access recovery
      • Upgrades
      • Upgrade Assistant
      • Security
        • Nodes info API response
        • Authorization errors
        • Error: Extra arguments provided
        • Active Directory account lockout
        • Certificate verification with curl on Mac
        • SSLHandshakeException
        • SSL/TLS exceptions
        • Kerberos
        • SAML
        • Kibana internal server error
        • Password setup failures
        • Configuration file locations
        • Error: Token invalid or expired
      • Error reference
        • Error: All shards failed
        • Error: Failed to parse field of type in document with id
        • Error: Unable to retrieve node fs stats
        • Error: Unable to parse response body
      • Clients
      • Diagnostics
      • More topics
        • Discovery
        • Monitoring
        • Transforms
        • CPS machine learning datafeeds
          • Troubleshoot datafeed project scope
          • Troubleshoot linked project unavailable
          • Troubleshoot project scope changes
          • Troubleshoot cloud credentials
          • Troubleshoot field mapping conflicts
        • Watcher
        • Apache Hadoop
    • Kibana
      • Server logs
      • Server status
      • Error: Server not ready
      • Trace Elasticsearch query
      • Monitoring
      • Alerts
      • Reporting
      • Task Manager
      • Maps
      • Graph
      • No-data screen in Discover and Dashboards
      • Migration and upgrades
      • Diagnostics
    • Observability
      • Explore data
      • Inspect
      • Synthetics
      • Uptime
      • Logs
      • APM
        • Common problems
        • APM Server or Elasticsearch is down
        • APM Server response codes
        • Processing and performance
        • APM Server binary debugging
        • APM Server performance diagnostic
        • APM Go Agent
        • APM Java Agent
        • APM .NET agent
        • APM Node.js Agent
        • APM PHP Agent
          • Agent is not instrumenting code
          • Collection of diagnostic information
        • APM Python Agent
        • APM Ruby Agent
        • APM Real User Monitoring JavaScript Agent
      • Amazon Data Firehose
      • Universal Profiling
        • Troubleshoot the backend
      • Infrastructure monitoring
        • Understand "no results found" message
        • Kubernetes Pods and Docker Containers views empty with Elastic OpenTelemetry
      • SLOs
    • Security
      • Detection rules
      • Elastic Defend
      • Indicators of compromise
    • Ingest tools
      • Elastic OpenTelemetry
        • Elastic Agent
          • Collector out of memory
          • Insufficient resources with Kube-Stack chart
          • Collector doesn’t propagate metadata
          • Enable debug logging
          • Collector doesn’t start
          • Collector sampling issues
          • elasticapm connector misconfigured
          • Export errors from the Elastic Agent
          • ResourceExhausted errors in Collector-to-Collector pipelines
        • EDOT SDKs
          • EDOT Android
          • EDOT .NET
          • EDOT iOS
          • EDOT Java
            • Proxy issues
          • EDOT Node.js
          • EDOT PHP
          • EDOT Python
          • Enable debug logging for SDKs
          • No app-level telemetry in Kibana
          • Proxy settings
          • SDK sampling issues
          • Trace context header propagation
        • No data visible in Kibana
        • Connectivity issues
        • 429 errors when using the mOTLP endpoint
        • Contact support
      • Logstash
        • Plugins
          • Kafka
          • Azure Event Hub
        • Health report pipelines
        • Contribute and discuss
        • Diagnostics
      • Fleet and Elastic Agent
        • Diagnostics
        • Common problems
        • Frequently asked questions
      • Elastic Logging Plugin for Docker
      • Elastic Serverless Forwarder
    • Elastic Cloud
      • Serverless status
      • SAML single sign-on (SSO)
      • Cloud Console access denied
      • Unavailable nodes
      • Unavailable shards
      • Performance
        • High memory pressure
        • Cluster performance metrics
        • Cluster response time
      • Node moves and system maintenance
      • Not enough capacity when expanding a deployment
      • Deployment health warnings
      • Node bootlooping
    • Elastic Cloud Enterprise
      • Common problems
      • IPv6 integration on AWS
      • Emergency roles token
      • Removing containers
      • Container engines
      • ZooKeeper sync status
      • Zookeeper quorum
      • Deployment health warnings
      • Node bootlooping
      • Diagnostics
      • Heap dumps
      • Thread dumps
    • Elastic Cloud on Kubernetes
      • Common issues
      • Resources and logs
      • Diagnostics
      • JVM heap dumps
      • Node bootlooping
  • Release notes
    • Release notes
    • Elastic Observability
      • Known issues
      • Breaking changes
      • Deprecations
    • Elastic Security
      • Known issues
      • Breaking changes
      • Deprecations
    • Elastic Cloud Serverless
      • Breaking changes
      • Known issues
      • Deprecations
  • Reference
    • Security
      • Fields and object schemas
        • Elastic Security ECS field reference
        • Timeline schema
        • Alert schema
      • Endpoint command reference
      • Elastic Defend advanced settings
    • Observability
      • Fields and object schemas
      • Infrastructure metrics reference
        • Host metrics
        • Container metrics
        • Kubernetes pod metrics
        • AWS metrics
    • Clients
    • Ingestion tools
    • Fleet and Elastic Agent
      • Restrictions for Elastic Cloud Serverless
      • Beats and Elastic Agent capabilities
      • Elastic Agent as an OTel Collector
      • Migrate from Beats to Elastic Agent
        • Migrate from Auditbeat to Elastic Agent
      • Deployment models
        • What is Fleet Server?
        • Deploy on Elastic Cloud
        • Deploy on-premises and self-managed
        • Deploy Fleet Server on-premises and Elasticsearch on Elastic Cloud
        • Deploy on Kubernetes
        • Fleet Server scalability
        • Fleet Server secrets
          • Secret files guide
        • Monitor a self-managed Fleet Server
      • Install Elastic Agents
        • Elastic Agent release process
        • Install Fleet-managed Elastic Agents
        • Install standalone Elastic Agents
          • Upgrade standalone Elastic Agents
        • Install Elastic Agents in a containerized environment
          • Run Elastic Agent in a container
          • Install Elastic Agent on Kubernetes using Helm
            • Example: Install standalone Elastic Agent on Kubernetes using Helm
            • Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm
          • Run Elastic Agent on Kubernetes managed by Fleet
          • Advanced Elastic Agent configuration managed by Fleet
          • Configuring Kubernetes metadata enrichment on Elastic Agent
          • Run Elastic Agent on GKE managed by Fleet
          • Configure Elastic Agent Add-On on Amazon EKS
          • Run Elastic Agent on Azure AKS managed by Fleet
          • Run Elastic Agent Standalone on Kubernetes
          • Scaling Elastic Agent on Kubernetes
          • Using a custom ingest pipeline with the Kubernetes Integration
          • Environment variables
        • Run Elastic Agent as an OTel Collector
        • Transform an installed Elastic Agent to run as an OTel Collector
        • Run Elastic Agent without administrative privileges
        • Install Elastic Agent from an MSI package
        • Installation layout
        • Air-gapped environments
        • Using a proxy server with Elastic Agent and Fleet
          • When to configure proxy settings
          • Proxy server connectivity using default host variables
          • Fleet-managed Elastic Agent connectivity using a proxy server
          • Standalone Elastic Agent connectivity using a proxy server
          • Set the proxy URL of the Elastic Package Registry
        • Uninstall Elastic Agents from edge hosts
        • Start and stop Elastic Agents on edge hosts
        • Elastic Agent configuration encryption
      • Secure connections
        • Configure SSL/TLS for self-managed Fleet Servers
        • Certificate fingerprints
        • Rotate SSL/TLS CA certificates
        • Elastic Agent deployment models with mutual TLS
        • One-way and mutual TLS certifications flow
        • Configure SSL/TLS for the Logstash output
      • Manage Elastic Agents in Fleet
        • Fleet settings
          • Elasticsearch output settings
          • Logstash output settings
          • Kafka output settings
          • Remote Elasticsearch output
            • Automatic integrations synchronization
          • Considerations when changing outputs
        • Elastic Agents
          • Unenroll Elastic Agents
          • Set inactivity timeout
          • Upgrade Elastic Agents
          • Migrate Elastic Agents
          • Restart agents
          • Monitor Elastic Agents
          • Elastic Agent built-in alerts
          • Elastic Agent health status
          • Add tags to filter the Agents list
          • Export agents to CSV
          • Enrollment handling for containerized agents
          • Remove agent elevated privileges
        • Policies
          • Create an agent policy without using the UI
          • Enable custom settings in an agent policy
          • Version-specific agent policies
        • Roles and privileges
        • Fleet enrollment tokens
        • Kibana Fleet APIs
      • Monitor OTel Collectors
        • Add an OTel Collector
        • View OTel Collectors
        • Remove an OTel Collector
        • Add internal telemetry
      • Configure standalone Elastic Agents
        • Create a standalone Elastic Agent policy
        • Structure of a config file
        • Inputs
          • Simplified log ingestion
          • Elastic Agent inputs
          • Variables and conditions in input configurations
        • Outputs
          • Elasticsearch
          • Kafka
          • Logstash
        • SSL/TLS
        • Logging
        • Feature flags
        • Agent download
        • Config file examples
          • Apache HTTP Server
          • Nginx HTTP Server
        • Grant standalone Elastic Agents access to Elasticsearch
        • Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
        • Example: Use standalone Elastic Agent with Elastic Cloud Hosted to monitor nginx
        • Debug standalone Elastic Agents
        • Kubernetes autodiscovery with Elastic Agent
          • Conditions based autodiscover
          • Hints annotations based autodiscover
        • Monitoring
        • Reference YAML
      • Manage integrations
        • Package signatures
        • Add an integration to an Elastic Agent policy
        • View integration policies
        • Edit or delete an integration policy
        • Install and uninstall integration assets
        • View integration assets
        • Set integration-level outputs
        • Scale integration policies
        • Upgrade an integration
        • Roll back an integration
        • Managed content
        • Best practices for integration assets
        • OpenTelemetry integration packages
        • Deprecated integrations
        • Data streams
          • Customize data retention policies
            • All data streams, all namespaces
            • Specific data streams, all namespaces
            • One data stream, one namespace
            • Custom integrations
          • Transform data with custom ingest pipelines
          • Customize data streams with namespace index templates
          • Apply an ILM policy to a namespace
          • Resolve overlapping index templates
          • Advanced data stream features
        • Integration alerting templates
      • Command reference
      • Agent providers
        • Local provider
        • Agent provider
        • Host provider
        • Env provider
        • Filesource provider
        • Kubernetes Secrets provider
        • Kubernetes LeaderElection Provider
        • Local dynamic provider
        • Docker provider
        • Kubernetes provider
      • Agent processors
        • Processor syntax
        • add_cloud_metadata
        • add_cloudfoundry_metadata
        • add_docker_metadata
        • add_fields
        • add_host_metadata
        • add_id
        • add_kubernetes_metadata
        • add_labels
        • add_locale
        • add_network_direction
        • add_nomad_metadata
        • add_observer_metadata
        • add_process_metadata
        • add_tags
        • community_id
        • convert
        • copy_fields
        • decode_base64_field
        • decode_cef
        • decode_csv_fields
        • decode_duration
        • decode_json_fields
        • decode_xml
        • decode_xml_wineventlog
        • decompress_gzip_field
        • detect_mime_type
        • dissect
        • dns
        • drop_event
        • drop_fields
        • extract_array
        • fingerprint
        • include_fields
        • move_fields
        • parse_aws_vpc_flow_log
        • rate_limit
        • registered_domain
        • rename
        • replace
        • script
        • syslog
        • timestamp
        • translate_sid
        • truncate_fields
        • urldecode
    • APM
      • APM settings
      • APM settings for Elastic Cloud
      • APM settings for Elastic Cloud Enterprise
    • APM agents
    • Machine learning
      • Kibana anomaly detection job wizards
        • Apache anomaly detection configurations
        • APM anomaly detection configurations
        • Auditbeat anomaly detection configurations
        • Logs anomaly detection configurations
        • Metricbeat anomaly detection configurations
        • Metrics anomaly detection configurations
        • Nginx anomaly detection configurations
        • Security anomaly detection configurations
        • Uptime anomaly detection configurations
      • ML function reference
        • Count functions
        • Geographic functions
        • Information content functions
        • Metric functions
        • Rare functions
        • Sum functions
        • Time functions
    • Glossary
    • AutoOps insights
  • Contribute to the docs
    • Contribute on the web
    • Contribute locally
    • Syntax quick reference
    • Content types
      • Changelogs
      • How-to guides
      • Overviews
      • Troubleshooting
      • Tutorials
    • How-to guides
      • Create good issues
      • Make your docs findable
      • Update Integrations docs
      • Write cumulative documentation
        • Guidelines
        • Badge usage and placement
        • Example scenarios
        • Quick reference
      • Document deployment types
        • Deployment types reference
        • Documentation strategies
    • Style guide
      • Voice and tone
      • Accessibility and inclusivity
      • Grammar and spelling
      • Word choice
      • Formatting
      • Writing about the UI
    • Tools
      • Elastic Docs Utilities
      • Vale style checker
    • Contribute to API docs
      • How API docs work
      • Checklist
      • Core guidelines
      • Organize and annotate docs
      • Quickstarts
        • Elasticsearch API docs
        • Kibana API docs
      • API docs by product
      • Report issues and get help
    • Contribute to Asciidoc docs
  • Extend and contribute
  • Documentation archive
  • Elastic documentation versions
Elastic logo

© 2026 Elasticsearch B.V. All Rights Reserved.

  • Terms of Use
  • Privacy