Elasticsearch

What it covers in an RCA

Use Elasticsearch when a service sends logs to ES instead of CubeAPM. The optional integration can check cluster health, locate a service's index, count errors in a time window, and search with Query DSL or SQL.

Credentials

The integration is wired only when ES_URL is set. Basic authentication uses:

ES_URL=https://elasticsearch.example.com:9200
ES_USERNAME=rca-readonly
ES_PASSWORD=replace_me

API-key authentication can be used instead:

ES_API_KEY_ID=replace_me
ES_API_KEY=replace_me

.envrc exports ES_READ_ONLY=true by default.

Read-only contract

With ES_READ_ONLY=true, es refuses mutating commands before sending a request. That is client-side defence-in-depth; the connected Elasticsearch role or API key should also be read-only. Keep searches bounded by the incident time range and result size.

Key commands

es cluster health -o json
es index list -o json | jq -r '.[].index' | grep -i <svc>
echo '{"query":{"bool":{"must":[{"match":{"level":"error"}},{"range":{"@timestamp":{"gte":"<ISO>","lte":"<ISO>"}}}]}}}' \
  | es search count <index> -f - -o json
es search query <index> -f - --size 20 --sort '@timestamp:desc' -o json
es search sql --query 'SELECT "@timestamp", message FROM "<index>" WHERE message LIKE '\''%error%'\'' ORDER BY "@timestamp" DESC LIMIT 20' -o json

Links

• Elasticsearch documentation
• es-cli source