Elasticsearch

The Elasticsearch tool gives a workbench read-only access to logs and documents stored in an Elasticsearch index. The agent queries the index using Elasticsearch's query syntax and can retrieve individual log entries or aggregate log counts over time.

Prerequisites

Before you begin, make sure you have:

• An Elasticsearch cluster that is already indexing the logs you want the workbench to query.
• Permission in Plural Console to create a configured tool and edit the target workbench.
• The Elasticsearch base URL.
• The index name or pattern to query (for example logs-*).
• A dedicated Elasticsearch user with appropriate permissions (see below).
• An existing workbench, or permission to create one. See Setting up a workbench.

Create an Elasticsearch user and role

Create a dedicated role scoped to the indices this tool should query. The role requires these index privileges:

• read — required to search the index
• view_index_metadata — required to inspect index structure

Optionally, add the monitor cluster privilege if your deployment requires cluster metadata access.

Create a service user and assign the role above. Save the username and password for the Console configuration step.

Capabilities