Skip to content

Elastic integration

Connect DXDT to Elasticsearch (log/data search) and, optionally, Kibana (Elastic Security SIEM, alerting rules, and cases) for read-only investigation: cluster health, index listings, query_string searches and counts, plus detection rules, alerting rules, and cases when a Kibana URL is provided. DXDT only searches and reads — it never indexes, updates, or deletes.
Setup time ~8 minutes
Difficulty Moderate

Access required: The Elasticsearch endpoint and a least-privilege read-only API key (preferred) or basic-auth credentials. A Kibana endpoint is optional and unlocks the SIEM/alerting/cases commands.

Prerequisites

  • The Elasticsearch endpoint URL, e.g. https://host:9200 or an Elastic Cloud .es.io URL.
  • Permission to create an API key in Kibana (Stack Management → API keys), or a read-only username/password.
  • Optional: the Kibana endpoint URL (e.g. an Elastic Cloud .kb.cloud.es.io URL) to enable Elastic Security commands.

Setup

In Kibana go to Stack Management → Security → API keys and create a key restricted with read-only role descriptors — typically cluster monitor plus read/view_index_metadata on only the indices DXDT should see. Copy the base64 id:api_key value; this becomes api_key.

  • Scope index privileges to the specific log/data patterns (e.g. logs-*) rather than *.
  • For Elastic Security commands, include read access to the relevant Security/alerting features via a read-only role.
  • As an alternative to an API key, you may use a read-only username + password instead.

2. Identify the Elasticsearch (and optional Kibana) URLs

Use the Elasticsearch endpoint as es_url (e.g. https://host:9200). If you want detection rules, alerting rules, and cases from Elastic Security, also supply the Kibana endpoint as kibana_url; leave it blank to use search-only features.

3. Enter the configuration in DXDT

In the DXDT marketplace, open the Elastic plugin. Enter es_url, optionally kibana_url, and provide authentication: paste the api_key, OR enter username + password. Save to install.

Configuration fields

Field Where to find it
Elasticsearch URL (es_url) Elasticsearch endpoint, e.g. https://host:9200 or an Elastic Cloud .es.io URL. Required.
Kibana URL (optional) (kibana_url) Optional — Kibana endpoint (e.g. .kb.cloud.es.io). Enables Elastic Security detections, alerting rules, and cases. Leave blank for search-only.
Username (username) Optional — basic-auth username; use with password as an alternative to api_key. Leave blank when using an API key.
Password (password) Optional — basic-auth password paired with username. Leave blank when using an API key.
API Key (api_key) Preferred auth — base64 id:api_key from Kibana Stack Management → API keys, with least-privilege read roles. Use this OR username+password.

Verify the connection

On save, DXDT calls ping, returning the Elasticsearch cluster name and version. You can then ask DXDT for cluster health or list indices to confirm read access; if kibana_url is set, try list detections to confirm Kibana connectivity.

Security

DXDT only searches and reads from Elasticsearch and Kibana — it never writes, updates, or deletes data or rules. Prefer an API key with least-privilege read roles scoped to the specific indices and Security features DXDT needs, rather than superuser or basic-auth admin credentials.

Troubleshooting

401/403 on ping

The api_key (or basic-auth pair) is invalid or lacks cluster monitor/read privileges. Recreate the API key with cluster monitor and index read privileges, or verify the username/password and its role.

Search returns 403 for some indices

The API key's role descriptor does not grant read on those index patterns. Extend the key's index privileges to include the required patterns (still read-only).

Detections/rules/cases commands fail

kibana_url is missing, incorrect, or the deployment lacks an Elastic Security license. Set a correct kibana_url and ensure the credential has read access to Security/alerting features.

TLS errors on a self-managed cluster

Elasticsearch presents a private-CA or self-signed certificate. Ensure the endpoint serves a trusted certificate, or terminate TLS at a trusted gateway that DXDT can reach.

Vendor documentation: https://www.elastic.co/guide/en/kibana/current/api-keys.html