Skip to main content
What you’ll get: ewake can query your Elasticsearch indices to retrieve logs, correlate log patterns with alerts, and surface relevant data during investigations, without requiring manual query construction.

​
Prerequisites

  • An Elasticsearch instance (Elastic Cloud or self-hosted)
  • Admin access to create an API key

​
Configuration

1

Create an API key in Kibana

In Kibana, go to Stack Management → Security → API Keys → click Create API key.Set the key privileges to read-only on the indices ewake should access:
read lets ewake search your logs; view_index_metadata lets it discover which indices, fields and data streams exist. No cluster or Kibana privileges are needed.Copy the generated API key immediately, it won’t be shown again.
2

Open the Elasticsearch integration in ewake

In your ewake dashboard, go to Integrations → Elasticsearch → click Connect with API key.Connect to Elasticsearch modal in ewake
3

Enter your credentials

Enter the Elasticsearch endpoint (.es.) here — not the Kibana URL (.kb.). On Elastic Cloud the two differ only by that one label, so it’s easy to paste the wrong one, and the Kibana URL is the most common cause of a failed connection test: ewake reaches Kibana’s login page instead of the Elasticsearch API. In the Elastic Cloud console, use Copy endpoint → Elasticsearch. The Kibana URL goes in the optional Kibana URL field.
4

Test and save

Click Test connection to verify the connection, then click Save.
Elasticsearch is connected. Ewake can now query your logs during investigations.

​
Behind Cloudflare Access or a proxy

If your Elasticsearch cluster sits behind an authenticating proxy, add the credentials it expects under Custom headers in the same dialog. For a Cloudflare Access service token that means two headers: Ewake sends these with every request. Values are stored encrypted, and are not shown again after saving, leaving the fields empty when you edit the connection keeps the headers you already saved.
Without this, a connection test against a proxied endpoint fails with an authentication or redirect error even though the URL and API key are both correct. It’s the most common cause of a test failing on a working instance.

​
Connect more than one cluster

Elasticsearch is a multi-instance integration: connect as many clusters as you need, one at a time. Give each cluster a Cluster name that tells them apart, for example eu, us. Letters, digits, - or _, starting with a letter or digit, max 64 characters. Each cluster keeps its own URL, API key, optional Kibana URL and custom headers. Ewake searches across all connected clusters during an investigation. They’re listed under Connected clusters in the integration dialog, where you can add another with Connect with API key or remove one on its own.
Ewake uses read-only access. It never writes to or modifies your Elasticsearch indices.