Skip to main content
Connect your Elasticsearch clusters to enable CloudThinker agents to search logs, analyze observability data, and investigate incidents. Elasticsearch authenticates with an API key scoped to specific indices and cluster permissions.

​
Prerequisites

  • An Elasticsearch (7.x, 8.x), OpenSearch (1.x, 2.x), AWS OpenSearch Service, or Elastic Cloud cluster reachable from CloudThinker.
  • Admin access to Kibana (Stack Management → Security → API Keys) or the Elasticsearch API to create an API key.
  • The cluster endpoint URL.

​
Setup

1

Open Kibana

Navigate to your Kibana instance and sign in with admin access.
2

Navigate to API Keys

Go to Stack Management → Security → API Keys.
3

Create API key

Click Create API key and enter:
  • Name: cloudthinker-readonly
4

Set permissions

Add role descriptors for read-only access (see Required permissions for the full JSON). At minimum, grant monitor on the cluster and read + view_index_metadata on the index patterns you need.
5

Generate and copy

Click Create API key and immediately copy the encoded key — Elasticsearch will not show it again.
6

Note the cluster endpoint

Copy your Elasticsearch endpoint:
  • Self-hosted: https://elasticsearch.your-domain.com:9200
  • Elastic Cloud: found in deployment settings
  • AWS OpenSearch: domain endpoint from the AWS console
7

Add connection in CloudThinker

Navigate to Connections → Elasticsearch and enter:
  • Cluster URL: your Elasticsearch endpoint
  • API Key: the encoded key you copied
  • Index patterns: patterns to access (e.g., logs-*)
Click Connect. CloudThinker verifies the credentials and shows a Connected status.
Copy the API key immediately after creation. Elasticsearch will not show it again, and you’ll need to create a new key if lost.

​
Connection details

Common index patterns to configure:

​
Required permissions

​
Minimum

Grant only read privileges on the index patterns CloudThinker needs. Never grant write or cluster-admin permissions to the CloudThinker API key.

​
Agent capabilities

Once connected, agents can:

​
Verify the connection

​
Example prompts

​
Troubleshooting

  • Verify the cluster URL is correct and accessible from CloudThinker.
  • Check that firewall rules allow CloudThinker’s egress IPs.
  • For AWS OpenSearch, enable public access or configure a VPC endpoint.
  • Confirm Elasticsearch is running and accepting requests.
  • Verify the API key is correct and has not expired.
  • Confirm the key has the required index and cluster permissions.
  • For AWS OpenSearch, verify the IAM role or access policy is correctly configured.
  • Navigate to Stack Management → Security → API Keys.
  • Create a new key with the same permissions.
  • Update the key in CloudThinker connection settings.
  • Verify index patterns match existing indices in the cluster.
  • Check the API key has read permission on those indices.
  • Ensure the indices contain data in the requested time range.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • API key rotation — rotate API keys every 90 days; set an expiration date when creating the key
  • Limited indices — restrict the key to the index patterns CloudThinker actually needs rather than granting access to *

Oliver Agent

Security log analysis

Grafana Connection

Visualize Elasticsearch data