Reference · built on requestConnectorDatabases & warehouses

Elasticsearch

Documents, search hits, and aggregations from Elasticsearch indices through its JSON REST API.

Request accessPricing ↗

About

Elasticsearch is a search and analytics engine from Elastic. It stores JSON documents in indices and data streams and answers requests through a REST API: Query DSL in the body of _search, ES|QL through /_query, SQL through the _sql endpoints, and aggregations over any field. The Document APIs index, update, and delete records one at a time or in batches through _bulk. It runs self-managed, on Elastic Cloud Hosted, or on Elastic Cloud Serverless.

Through Fibric, an operator runs the searches and aggregations you define against the indices you name and reads the hits, buckets, and field capabilities that come back. When it wants to write, it proposes a bulk request or a document update for your approval, and the connector sends it once.

This is a reference listing. It documents what Fibric would read from Elasticsearch and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Documents matched by a Query DSL search through the _search endpoint, with hits, sort values, and _source fields
  • Aggregation results: buckets and metrics computed inside a search request over the indices you name
  • Rows from ES|QL queries sent to POST /_query, with long runs through /_query/async
  • Deep result sets paged with search_after and a point in time opened through _pit
  • Field names and types across indices from _field_caps, and match counts from _count
  • Single documents by id through GET /{index}/_doc/{id}, and batches through _mget

Proposed actions

  • Target capability: propose indexing or deleting a batch of documents through the _bulk endpoint
  • Target capability: propose a partial update to one document through POST /{index}/_update/{id}
  • Target capability: propose an _update_by_query run over the documents a query matches, throttled by its task id

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Trace an outage back to its first error

    Application logs land in a data stream. When uptime drops, the operator runs a range query and a terms aggregation over error codes, reads the earliest matching hits, and attaches them to the incident it drafts.

    With Root Cause, Uptime Response

  • Notice when an index stops receiving data

    The operator runs a max aggregation on the timestamp field of each index you name. When the newest document falls behind the expected interval, it names the index and the pipeline feeding it.

    With Data Freshness

  • Find the article a customer could not

    Help-center articles sit in an index. For each unanswered question, the operator runs a match query, reads the top hits and their scores, and proposes an article to write or rename.

    With Knowledge Gap

Requirements

  • An Elasticsearch cluster reachable over HTTPS: self-managed, Elastic Cloud Hosted, or Elastic Cloud Serverless
  • An API key or user with read privileges on the indices and data streams you name
  • For writes, write privileges on the target indices
  • To create API keys, the manage_api_key or manage_own_api_key privilege
Authentication
An Elasticsearch API key sent as Authorization: ApiKey, or basic credentials for a user whose roles grant the index privileges the connector needs.

Limits

  • from and size cannot page past 10,000 hits, the index.max_result_window default. Deeper reads use search_after with a point in time
  • Open scroll contexts are capped at 500 per cluster by default, and Elastic no longer recommends scroll for deep paging
  • The Search and Document APIs push no change feed. Watcher can schedule a query and call a webhook, but not on Elastic Cloud Serverless
  • Personal API keys created with Kibana's quick option expire 90 days after creation unless you set another expiry

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Elasticsearch ↗

Questions and answers

Does Elasticsearch send webhooks when a document changes?
Not from the Document or Search APIs. Watcher runs a scheduled query, checks a condition, and can push the result through a webhook, an email, or an index action. Watcher is generally available on the Elastic Stack and unavailable on Elastic Cloud Serverless.
How does the connector page through more than 10,000 results?
With search_after and a point in time. from and size stop at index.max_result_window, which defaults to 10000. A PIT opened through _pit fixes the index state and adds a _shard_doc tiebreaker so pages stay consistent.
Which query languages does Elasticsearch accept over HTTP?
Query DSL in the body of _search, ES|QL through POST /_query and /_query/async, SQL through the _sql endpoints, and EQL through _eql. Aggregations run inside a _search request. _msearch bundles several searches in one call.
Ask about Elasticsearch

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Elasticsearch through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy