> For the complete documentation index, see [llms.txt](https://docs.ilert.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ilert.com/ai-and-agents/mcp/hosted/elasticsearch.md).

# Elasticsearch

Give an agent access to Elasticsearch with an API key scoped to the permissions it needs.

#### Required permissions

<table><thead><tr><th width="162.7890625">Tool</th><th width="179.15625">Required Permission</th><th>Description</th></tr></thead><tbody><tr><td><code>list_indices</code></td><td><code>read</code>, <code>monitor</code></td><td>List all Elasticsearch indices matching a pattern. Use this to discover available data sources in your cluster. Examples: '<em>' for all indices, e.g. 'my-app-</em>', for application-specific indices.</td></tr><tr><td><code>search_logs</code></td><td><code>read</code></td><td>Search through Elasticsearch logs with flexible query options. Use this to find specific log entries, filter by time range, or search for particular content. Perfect for log analysis and troubleshooting. Use the 'list_indices' tool to discover available indices. Don't assume the index name, always use the 'list_indices' tool to discover the available indices.</td></tr><tr><td><code>get_log_by_id</code></td><td><code>read</code></td><td>Retrieve a specific log entry by its document ID. Use this when you know the exact document ID and want to fetch a single log entry.</td></tr><tr><td><code>aggregate_logs</code></td><td><code>read</code></td><td>Perform aggregations on Elasticsearch logs to analyze data patterns, counts, and statistics. Use this for log analytics, monitoring dashboards, and data insights.</td></tr></tbody></table>

#### Create API key

Using the Elastic MCP server requires an API key with appropriate permissions.

**Option 1: Create API key via Elasticsearch API**

{% stepper %}
{% step %}
Log in to your Elasticsearch cluster or Elastic Cloud instance.
{% endstep %}

{% step %}
Generate an API key using the Elasticsearch API:

{% code title="Create API key (curl)" %}

```bash
curl -X POST "https://your-elastic-instance:9200/_security/api_key" \
  -H "Content-Type: application/json" \
  -u elastic:your-password \
  -d '{
    "name": "ilert-mcp-agent",
    "expiration": "365d",
    "role_descriptors": {
      "ilert_readonly": {
        "cluster": ["monitor"],
        "index": [
          {
            "names": ["*"],
            "privileges": ["read", "monitor"]
          }
        ]
      }
    }
  }'
```

{% endcode %}
{% endstep %}

{% step %}
The response will contain an `id` and `api_key`. Combine them as `id:api_key` (this is your API key).
{% endstep %}

{% step %}
Copy the API key and temporarily paste it somewhere secure (e.g., a private note). You will need this API key when setting up the Elastic MCP server in ilert.
{% endstep %}
{% endstepper %}

**Option 2: Create API key via Kibana**

{% stepper %}
{% step %}
Log in to Kibana.
{% endstep %}

{% step %}
Navigate to Management → Security → API Keys.
{% endstep %}

{% step %}
Click Create API key.
{% endstep %}

{% step %}
Enter a name (e.g., "ilert-mcp-agent").
{% endstep %}

{% step %}
Set expiration (optional, recommended for security).
{% endstep %}

{% step %}
Under Role descriptors, configure the following:

```bash
curl -X POST "https://your-elastic-instance:9200/_security/role/ilert_readonly" \
  -H "Content-Type: application/json" \
  -u elastic:your-password \
  -d '{
    "cluster": ["monitor"],
    "indices": [
      {
        "names": ["*"],
        "privileges": ["read", "monitor"]
      }
    ]
  }'
```

{% endstep %}
{% endstepper %}

**Connect Elastic with agent**

To connect Elastic with your AI SRE agent:

{% stepper %}
{% step %}
Navigate to **Agents** in the ilert navigation menu
{% endstep %}

{% step %}
Open the agent detail view for the agent you want to configure
{% endstep %}

{% step %}
Go to the **Tools** tab
{% endstep %}

{% step %}
Under the **ilert hosted MCP servers** section, locate the **Elastic** card
{% endstep %}

{% step %}
Click **Connect** on the Elastic card
{% endstep %}

{% step %}
In the connection dialog that appears:

* **Select connector:** Choose "Create new connector" (or select an existing connector if you have one)
* **Type:** Select **API Key** from the dropdown
* **Secret name:** Enter a name for your connector (e.g., "Elastic Production" or "Elastic Main")
* **Secret value:** Paste the API key you created earlier (format: `id:api_key`)
* **Host URL:** Enter your Elasticsearch instance URL (e.g., `https://elastic.example.com:9200`)
  {% endstep %}

{% step %}
Click **Connect** to complete the connection
{% endstep %}

{% step %}
After connecting, you can enable or disable specific tools needed for alert investigation, such as:

* `list_indices` - List all Elasticsearch indices matching a pattern
* `search_logs` - Search through Elasticsearch logs with flexible query options
* `get_log_by_id` - Retrieve a specific log entry by its document ID
* `aggregate_logs` - Perform aggregations on Elasticsearch logs to analyze data patterns
  {% endstep %}
  {% endstepper %}

The Elastic integration is now connected and ready to use for root cause analysis.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ilert.com/ai-and-agents/mcp/hosted/elasticsearch.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.