Skip to main content

Elasticsearch

This section explains how to create an Elasticsearch data source in DataDios and how to keep its password, API key and CA certificate in a Secret Store instead of typing them into the form.

Connection Details​

In the Connection Details form, provide the parameters:

  • Host: Elasticsearch host or IP address (default: localhost)
  • Port: Elasticsearch port (default: 9200)
  • Scheme: http or https (default: http)
  • Username: Login username (optional)
  • Password: Login password (optional)
  • API Key: API key, used instead of username and password (optional)
  • Cloud ID: Elastic Cloud ID, used instead of host, port and scheme (optional)
  • Verify Certs: true or false (default: true)
  • CA Certs: The CA certificate that signed the cluster's certificate (optional)

Click Test Connection, then Create.

Using a Secret Store​

Password, API Key and CA Certs can each come from a Secret Store (for example Azure Key Vault) instead of being typed in.

  1. Create the Secret Store data source first.
  2. In the Elasticsearch form, switch the field's selector from Direct Input (the default) to From Secret Store.
  3. Pick the Secret Store data source and enter the Secret Name to read.

Each of the three fields is chosen separately, so the password can come from a Secret Store while the CA certificate is typed in.

Existing Elasticsearch data sources keep working unchanged: they stay on Direct Input until you switch a field.

CA Certs​

CA Certs accepts either:

  • A file path on the DataDios server, for example /opt/datadios/configs/certs/elastic_ca.crt; or
  • The certificate text itself, starting with -----BEGIN CERTIFICATE-----.

Notes:

  • A certificate stored as a secret must keep its line breaks. Store the full PEM text exactly as it appears in the .crt file, including the BEGIN and END lines. A certificate flattened onto one line cannot be read.
  • Direct Input for this field is a single-line masked box, and a browser removes line breaks from pasted text. To use certificate text, store it in a Secret Store and choose From Secret Store. A file path works with either choice.
  • When Verify Certs is false, the certificate is ignored and the server's certificate is not checked.
  • If the certificate text cannot be read, Test Connection fails with "The CA certificate could not be parsed as PEM".

Best Practices​

  1. Keep the password, API key and CA certificate in a Secret Store so they are not stored with the data source.
  2. Leave Verify Certs on for any cluster reachable over https.