Elasticsearch Service Billing
| Version | 1.4.1 (View all) |
| Compatible Kibana version(s) | 8.15.0 or higher 9.0.0 or higher |
| Supported Serverless project types What's this? |
Security Observability |
| Subscription level What's this? |
Basic |
| Level of support What's this? |
Community |
The Elasticsearch Service Billing integration allows you to monitor Elasticsearch Service usage and costs. It collects billing data from the Elasticsearch Service billing API and sends it to your target Elasticsearch cluster. Dashboards are provided out-of-the-box to help you visualize your Elasticsearch Service usage and costs.
Using this integration, you could for instance create alerts whenever a new deployment is created, or when your baseline spending exceeds a certain threshold.
The Elasticsearch Service Billing integration collects the following data streams:
- Your daily spending in the
metrics-ess_billing.billingdata stream. - For customers with a yearly commitment with Elastic, your credit status in the
metrics-ess_billing.creditdata stream.
By default, the last year of data of billing data is collected upon first execution of the integration. The data is then collected daily, the integration will automatically collect the latest data every day.
You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
You will need to recover the identifier of your organization, which can be seen in the cloud organization page.
You will also need to provision an API key with the Billing admin role in the API keys page.
For private cloud, or admin users, the cloud endpoint can be altered to match your requirements. You can change this in the "advanced settings" section of the integration configuration.
For step-by-step instructions on how to set up an integration, see the Getting started guide.
If you run in the cloud (Cloud Hosted of Serverless), this integration is available agentless from cluster version 8.17 onward - if this criteria is met, you don't need to install an Elastic Agent to gather these metrics.
The metrics-ess_billing.billing data stream collects billing data from the Elasticsearch Service billing API. This exposes information about the ECU consumption for each deployment or service provided by Elastic (serverless projects, synthetics monitors).
Example
{
"@timestamp": "2024-01-10T00:00:00.000Z",
"agent": {
"ephemeral_id": "fb0f134f-4261-49f2-922c-6f2785960a4e",
"id": "6c2fb3e5-8b0c-4044-a920-bc47cd3ac9a3",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.15.1"
},
"cloud": {
"account": {
"id": "3166899605"
},
"geo": {
"location": {
"lat": 53.34979997947812,
"lon": -6.260300064459443
},
"name": "gcp-europe-west1"
},
"instance": {
"id": "eb4bdbcfca05493bb72aa0b65cc1a2d3",
"name": "monitoring"
},
"machine": {
"type": "es.ml.n2.68x32x45"
},
"provider": "gcp",
"region": "gcp-europe-west1"
},
"data_stream": {
"dataset": "ess_billing.billing",
"namespace": "default",
"type": "metrics"
},
"ecs": {
"version": "8.0.0"
},
"elastic_agent": {
"id": "6c2fb3e5-8b0c-4044-a920-bc47cd3ac9a3",
"snapshot": false,
"version": "8.15.1"
},
"ess": {
"billing": {
"deployment_id": "eb4bdbcfca05493bb72aa0b65cc1a2d3",
"deployment_name": "monitoring",
"display_quantity": {
"formatted_value": "24 hours",
"type": "default",
"value": 24
},
"from": "2024-01-10T00:00:00.000Z",
"kind": "elasticsearch",
"name": "Cloud Standard, GCP europe-west1 (Belgium), gcp.es.ml.n2.68x32x45, 8GB, 1AZ",
"organization_id": "3166899605",
"quantity": {
"formatted_value": "24 hours",
"value": 24
},
"ram_per_zone": 8192,
"rate": {
"formatted_value": "0.3528 per hour",
"value": 0.3528
},
"sku": "gcp.es.ml.n2.68x32x45_gcp-europe-west1_8192_1",
"to": "2024-01-11T00:00:00.000Z",
"total_ecu": 8.4672,
"type": "capacity",
"unit": "hour",
"zone_count": 1
}
},
"event": {
"agent_id_status": "verified",
"created": "2024-10-28T08:41:53.653Z",
"dataset": "ess_billing.billing",
"ingested": "2024-10-28T08:41:53Z",
"module": "ess_billing"
},
"input": {
"type": "cel"
},
"tags": [
"billing",
"forwarded"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| cloud.account.id | keyword | |
| data_stream.dataset | Data stream dataset. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| ess.billing.cloud.machine.type | The machine type of the instance (e.g., n2.68x16x45). | keyword |
| ess.billing.deployment_id | ID of the Elasticsearch Service deployment. | keyword |
| ess.billing.deployment_name | Name of the Elasticsearch Service deployment. | keyword |
| ess.billing.display_quantity.formatted_value | Human-readable representation of the quantity used (e.g., "24 hours"). | keyword |
| ess.billing.display_quantity.type | Type of quantity displayed (default or custom). | keyword |
| ess.billing.display_quantity.value | Actual quantity used (e.g., 24). | float |
| ess.billing.from | Start time of the billing period. | date |
| ess.billing.kind | Type of service being billed (e.g., elasticsearch, kibana). | keyword |
| ess.billing.name | Description of the SKU or resource being billed. | keyword |
| ess.billing.organization_id | ID of the organization in Elastic Cloud. | keyword |
| ess.billing.quantity.formatted_value | Human-readable representation of the billed quantity (e.g., "24 hours"). | keyword |
| ess.billing.quantity.value | Billed quantity. | float |
| ess.billing.ram_per_zone | RAM size per zone in megabytes. | integer |
| ess.billing.rate.formatted_value | Human-readable representation of the rate (e.g., "0.7992 per hour"). | keyword |
| ess.billing.rate.value | Billed rate per unit of usage. | float |
| ess.billing.sku | Unique identifier for the service or product (SKU). | keyword |
| ess.billing.to | End time of the billing period. | date |
| ess.billing.total_ecu | Total Elasticsearch Compute Units (ECU) used. | float |
| ess.billing.type | Type of billing (e.g., capacity, usage). | keyword |
| ess.billing.unit | Unit of the resource being billed (e.g., hour, GB). | keyword |
| ess.billing.zone_count | Number of availability zones. | integer |
| event.module | Event module | constant_keyword |
| input.type | keyword |
The metrics-ess_billing.credit data stream collects credit data from the Elasticsearch Service billing API. This is only available for customers with a direct yearly or multi-year contract with Elastic (not marketplace or monthly subscriptions).
Example
{
"@timestamp": "2025-01-29T15:57:57.368Z",
"agent": {
"ephemeral_id": "3fefd74f-7a64-4bad-82e8-6c226de5d333",
"id": "bb84ef9e-6cd6-4177-822a-b3a0f05644f3",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.17.0"
},
"cloud": {
"account": {
"id": "12345678"
}
},
"data_stream": {
"dataset": "ess_billing.credits",
"namespace": "default",
"type": "metrics"
},
"ecs": {
"version": "8.0.0"
},
"elastic_agent": {
"id": "bb84ef9e-6cd6-4177-822a-b3a0f05644f3",
"snapshot": false,
"version": "8.17.0"
},
"ess": {
"billing": {
"active": false,
"ecu_balance": 1463000,
"ecu_quantity": 1463000,
"start": "2025-07-01T00:00:00.000Z",
"end": "2026-06-30T23:59:59.999Z",
"organization_id": "12345678",
"type": "prepaid_consumption"
}
},
"event": {
"agent_id_status": "verified",
"dataset": "ess_billing.credits",
"ingested": "2025-01-29T15:57:58Z"
},
"input": {
"type": "cel"
},
"tags": [
"billing",
"forwarded"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| cloud.account.id | keyword | |
| data_stream.dataset | Data stream dataset. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| ess.billing.active | Whether the credit line is active. | boolean |
| ess.billing.ecu_balance | Balance of Elastic Consumption Units (ECUs) in the credit line. | long |
| ess.billing.ecu_quantity | Initially purchased quantity of Elastic Consumption Units (ECUs) in the credit line. | long |
| ess.billing.end | End date of the credit line. | date |
| ess.billing.organization_id | ID of the organization in Elastic Cloud. | keyword |
| ess.billing.start | Start date of the credit line. | date |
| ess.billing.type | Type of the credit line. | keyword |
| input.type | keyword |
Changelog
| Version | Details | Kibana version(s) |
|---|---|---|
| 1.4.1 | Enhancement (View pull request) Fix organization ID scientific notation issue |
8.15.0 or higher 9.0.0 or higher |
| 1.4.0 | Enhancement (View pull request) 9.x integration compatibility |
8.15.0 or higher 9.0.0 or higher |
| 1.3.0 | Enhancement (View pull request) Aligned billing data pulls to calendar days |
8.15.0 or higher |
| 1.2.0 | Enhancement (View pull request) Added Agentless deployment mode |
8.15.0 or higher |
| 1.1.0 | Enhancement (View pull request) Changed credits collection mechanism, fixed stalling issue and fixed duplicate credit count issue |
8.15.0 or higher |
| 1.0.1 | Bug fix (View pull request) Updated SSL description to be uniform and to include links to documentation. |
8.15.0 or higher |
| 1.0.0 | Enhancement (View pull request) GA release of the integration, addition of credit endpoint |
8.15.0 or higher |
| 0.1.1 | Bug fix (View pull request) Update links to getting started docs |
— |
| 0.1.0 | Enhancement (View pull request) Initial draft of the package |
— |