Elastic

Elastic is a comprehensive search, observability, and security platform built on the Elastic Stack (formerly known as the ELK Stack), which includes Elasticsearch, Logbeat, Kibana, and other tools. It provides powerful real-time search, analytics, and data visualization capabilities for organizations to monitor, search, and analyze large volumes of data from multiple sources.

Category	Database
Direction	Query source
Sign-in	No Authentication, API Key, Username / Password, API Token (Bearer)
Query languages	STIX, ES Query DSL, ES|QL
Query templates	4
Website	elastic.co

Before you start

Huntbase can sign in to Elastic with any of these methods: API Key, Username / Password, API Token (Bearer). Pick one, create the credential in Elastic, then keep it to hand for the Connect step.

API Key

Elastic API key auth requires BOTH the API Key ID and the API Key value (sent as ApiKey base64(id:api_key)).

1. In Kibana, open the API keys management page from the navigation menu or the global search field.
2. Select Create API key and choose a user API key.
3. Enter a name and, optionally, an expiry date. By default the key doesn't expire.
4. Under Configure access, limit the key to the read index privilege on the indices or data streams you want to search.
5. Create the key and save both its id and its api_key value.

Permissions:

• manage_own_api_key cluster privilege (to create the key)
• read index privilege on the indices you want to search

Watch out for

• Elastic's encoded value is the base64 of id:api_key. If you copied only the encoded value, base64-decode it and split it at the colon to get the two fields.

For the vendor's own instructions, see Elasticsearch API key documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Elastic

1. Go to Connections and click New connection, or click New connection on the Elastic product page.
2. On Product, pick Elastic and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Elastic lives:

Field	Required	Notes
Server Address	Yes	The Elasticsearch endpoint that serves the search API, not the Kibana URL.
Port	Yes	Set the port number that is associated with the hostname or IP address. Defaults to 9200.
Indices	No	A comma-separated list of indices, such as logs-*, winlogbeat-*. Leave blank to search all indices.

Advanced settings

These settings are under Advanced. You can usually leave them alone.

Field	Required	Notes
Enable Pagination	No	Whether or not to enable pagination support in Elasticsearch; pagination enables infinite result retrieval, but requires sorting, which could cause performance issues in Elasticsearch.
Page Size	No	Documents fetched per page when pagination is enabled (point-in-time + search_after). Defaults to 2000 if unset; raise for throughput, lower for memory-constrained or rate-limited clusters.
Max Results	No	Maximum rows fetched per run (1–10000). Lower this for very large indices to keep responses fast and avoid timeouts; the ES default index.max_result_window (10000) is the ceiling. Defaults to 1000.
Query Timeout (seconds)	No	Per-request timeout for the Elasticsearch search. Raise for slow or heavily-loaded clusters; keep below any upstream proxy/CDN limit (e.g. Cloudflare's ~100s). Defaults to 60.
Self-Signed Cert (PEM)	No	Provide a self-signed or CA-signed certificate to securely communicate with the data source.

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

No Authentication

No fields — choose this method to connect without credentials.

API Key

Field	Required	Notes
API Key ID	Yes	The key's id. Secret — not shown again after you save it.
API Key	Yes	The key's api_key value, not the encoded value. Secret — not shown again after you save it.

Username / Password

Field	Required	Notes
Username	Yes	Username with access to the search API. Secret — not shown again after you save it.
Password	Yes	Password of the user with access to the search API. Secret — not shown again after you save it.

API Token (Bearer)

Field	Required	Notes
Access Token	Yes	Access Token is required for token based authentication. Secret — not shown again after you save it.

Query it

Once connected, Elastic can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
STIX	STIX patterns for indicator sweeps, translated into the product's native search.
ES Query DSL	Native Elasticsearch Query DSL (JSON), sent as written.
ES|QL	Native ES|QL, sent as written.

Example: STIX

Suspicious URL or IP across ECS — Hunt for a suspicious URL or IP address across Elasticsearch ECS events using a STIX pattern.

[url:value = '{{url}}'] OR [ipv4-addr:value = '{{ip}}']

Example: ES Query DSL

Process executions for a user — Lucene query_string to retrieve process events for a specified user.

event.category:process AND user.name:{{user}}

Example: ES|QL

Top source IPs by event volume — ES|QL aggregation counting events per source IP and returning the busiest addresses first.

FROM logs-*
| STATS event_count = COUNT(*) BY source.ip
| SORT event_count DESC
| LIMIT 20

Elastic ships with 4 query templates. Find them in Library › Queries — see Query templates.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog