Elasticsearch

{
  "tools": {
    "elasticsearch": {
      "enabled": true,
      "hosts": ["https://elasticsearch.your-domain.com:9200"],
      "auth": "vault://secrets/elasticsearch-credentials",
      "index_pattern": "logs-*"
    }
  }
}

{
  "tools": {
    "elasticsearch": {
      "enabled": true,
      "hosts": ["https://elasticsearch.your-domain.com:9200"],
      "api_key": "vault://secrets/elasticsearch-api-key",
      "index_pattern": "logs-*"
    }
  }
}

@incidentfox search elasticsearch for errors in the payments service

@incidentfox what are the most common error types in the last hour?

@incidentfox find logs containing "connection refused" from the API service

{
  "tools": {
    "elasticsearch": {
      "index_pattern": "logs-*",
      "default_time_field": "@timestamp"
    }
  }
}

{
  "tools": {
    "elasticsearch": {
      "index_patterns": {
        "application": "app-logs-*",
        "system": "syslog-*",
        "audit": "audit-*"
      }
    }
  }
}

{
  "cluster": ["monitor"],
  "indices": [
    {
      "names": ["logs-*"],
      "privileges": ["read", "view_index_metadata"]
    }
  ]
}

Error: Unable to connect to Elasticsearch

{
  "tools": {
    "elasticsearch": {
      "timeout": "60s",
      "max_results": 1000
    }
  }
}