SigSentry Documentation

The Elastic adapter works with Elasticsearch (self-hosted or Elastic Cloud) and OpenSearch (Amazon OpenSearch Service or self-hosted). The query API is compatible across both.

Prerequisites

Need	Notes
Elasticsearch / OpenSearch URL	e.g. `https://es.company.com:9200` or `https://search-prod.us-east-1.es.amazonaws.com`
Authentication	API key (recommended), Basic auth, or AWS SigV4 for OpenSearch on AWS
Indices	The indices to query

Setup walkthrough

Generate an API key

For Elasticsearch / Elastic Cloud, in Kibana go to Stack Management → API Keys → Create API key. Limit it to read-only on the indices SigSentry needs.

For Amazon OpenSearch Service, you'll typically use master-user Basic auth or IAM-signed requests. The Elastic adapter supports both — choose based on what your OpenSearch domain accepts.

For Amazon OpenSearch with fine-grained access control, create a dedicated user with read permissions on the relevant indices and use Basic auth.

Add the log source in SigSentry

Project → Log Sources → Add log source. Pick Elastic / OpenSearch and name it descriptively, e.g. elastic-prod.

Enter connection details

Field	Value
URL	The full Elasticsearch / OpenSearch URL, e.g. `https://es.example.com:9200`
API key	API key (recommended) — sent as `Authorization: ApiKey ...`
Username + password	Basic auth alternative

You can also leave both blank for unauthenticated clusters (rare in production).

Add indices

Paste the index names or patterns into the Indices field, one per line. Index patterns with wildcards work:

prod-app-logs-*
prod-api-logs-*
prod-billing-2026-*

Test and save

Click Test connection. You should see Connected plus sample documents from a small recent window. Click Save.

What you'll see in results

Each Elastic log line shown in an analysis includes:

Timestamp (from @timestamp by default)
Log level (from log.level, level, or severity)
Service name (from service.name, kubernetes.labels.app, or host.name)
Message
Other top-level fields carried through as metadata

If your indices use a custom timestamp field, mention it in your project AI context so the analysis knows which field to interpret.

Quirks

Quirk	Notes
Custom timestamp field	If your indices use something other than `@timestamp`, configure it in the project AI context
Multiple clusters	Add a separate log source per cluster
OpenSearch on AWS	IAM SigV4 auth available; OpenSearch Service requires either master user or fine-grained roles

Troubleshooting

Error	Fix
`401 Unauthorized`	API key invalid or expired; regenerate
`403 Forbidden`	User lacks read on one of the configured indices
`404 index_not_found_exception`	An index in your list doesn't exist; remove or fix the pattern
Slow queries	Indices too broad; narrow with date-suffix patterns or use rollover indices

Elastic / OpenSearch

On this page