Elasticsearch

Give an agent access to Elasticsearch with an API key scoped to the permissions it needs.

Required permissions

Tool	Required Permission	Description
list_indices	read, monitor	List all Elasticsearch indices matching a pattern. Use this to discover available data sources in your cluster. Examples: '' for all indices, e.g. 'my-app-', for application-specific indices.
search_logs	read	Search through Elasticsearch logs with flexible query options. Use this to find specific log entries, filter by time range, or search for particular content. Perfect for log analysis and troubleshooting. Use the 'list_indices' tool to discover available indices. Don't assume the index name, always use the 'list_indices' tool to discover the available indices.
get_log_by_id	read	Retrieve a specific log entry by its document ID. Use this when you know the exact document ID and want to fetch a single log entry.
aggregate_logs	read	Perform aggregations on Elasticsearch logs to analyze data patterns, counts, and statistics. Use this for log analytics, monitoring dashboards, and data insights.

Create API key

Using the Elastic MCP server requires an API key with appropriate permissions.

Option 1: Create API key via Elasticsearch API

1

Log in to your Elasticsearch cluster or Elastic Cloud instance.

2

Generate an API key using the Elasticsearch API:

Create API key (curl)

curl -X POST "https://your-elastic-instance:9200/_security/api_key" \
  -H "Content-Type: application/json" \
  -u elastic:your-password \
  -d '{
    "name": "ilert-mcp-agent",
    "expiration": "365d",
    "role_descriptors": {
      "ilert_readonly": {
        "cluster": ["monitor"],
        "index": [
          {
            "names": ["*"],
            "privileges": ["read", "monitor"]
          }
        ]
      }
    }
  }'

3

The response will contain an id and api_key. Combine them as id:api_key (this is your API key).

4

Copy the API key and temporarily paste it somewhere secure (e.g., a private note). You will need this API key when setting up the Elastic MCP server in ilert.

Option 2: Create API key via Kibana

1

Log in to Kibana.

2

Navigate to Management → Security → API Keys.

3

Click Create API key.

4

Enter a name (e.g., "ilert-mcp-agent").

5

Set expiration (optional, recommended for security).

6

Under Role descriptors, configure the following:

curl -X POST "https://your-elastic-instance:9200/_security/role/ilert_readonly" \
  -H "Content-Type: application/json" \
  -u elastic:your-password \
  -d '{
    "cluster": ["monitor"],
    "indices": [
      {
        "names": ["*"],
        "privileges": ["read", "monitor"]
      }
    ]
  }'

Connect Elastic with agent

To connect Elastic with your AI SRE agent:

1

Navigate to Agents in the ilert navigation menu

2

Open the agent detail view for the agent you want to configure

3

Go to the Tools tab

4

Under the ilert hosted MCP servers section, locate the Elastic card

5

Click Connect on the Elastic card

6

In the connection dialog that appears:

• Select connector: Choose "Create new connector" (or select an existing connector if you have one)
• Type: Select API Key from the dropdown
• Secret name: Enter a name for your connector (e.g., "Elastic Production" or "Elastic Main")
• Secret value: Paste the API key you created earlier (format: id:api_key)
• Host URL: Enter your Elasticsearch instance URL (e.g., https://elastic.example.com:9200)

7

Click Connect to complete the connection

8

After connecting, you can enable or disable specific tools needed for alert investigation, such as:

• list_indices - List all Elasticsearch indices matching a pattern
• search_logs - Search through Elasticsearch logs with flexible query options
• get_log_by_id - Retrieve a specific log entry by its document ID
• aggregate_logs - Perform aggregations on Elasticsearch logs to analyze data patterns

The Elastic integration is now connected and ready to use for root cause analysis.