Docs
  • Release notes
  • Troubleshoot
  • Reference
  • Elastic fundamentals
  • Solutions and use cases
  • Manage data
  • Explore and analyze
  • Deploy and manage
  • Manage your Cloud account and preferences
  • Troubleshoot
  • Release notes
  • Reference
  • Contribute to the docs
  • Extend and contribute
  • Elastic fundamentals
    • Solutions
    • The Elastic Stack
    • Deployment options
    • Versioning and availability
    • How to use the documentation
    • Glossary
  • Solutions and use cases
    • Elasticsearch
      • Get started
        • Find connection details
        • Elasticsearch quickstarts
          • Index and search basics
          • Keyword search with Python
          • Semantic search
      • Ingest for search use cases
        • Ingest pipelines for search use cases
      • Search approaches
        • Full-text search
          • How full-text search works
          • Search with synonyms
            • Create or update synonyms set API examples
          • Text analysis during search
          • Search relevance optimizations
            • Mixing exact search with stemming
            • Getting consistent scoring
            • Incorporating static relevance signals into the score
        • AI-powered search
          • Vector search
            • Dense vector
              • kNN search in Elasticsearch
              • Bring your own dense vectors
            • Sparse vector search in Elasticsearch
            • Tutorial: Manual dense and sparse workflows
          • Semantic search
            • Semantic search with semantic_text
            • Semantic search with the inference API
            • Semantic search with ELSER (ingest pipelines)
            • Using Cohere with Elasticsearch
          • Using OpenAI compatible models
        • Hybrid search
          • Hybrid search with semantic_text
        • Ranking and reranking
          • Semantic reranking
          • Learning To Rank (LTR)
            • Deploy and manage LTR models
            • Search using LTR
      • Build search queries
        • The _search API
        • The async-search API
        • ES|QL for search
        • Retrievers
        • Search templates
      • Agent Builder
        • Get started
        • Models
        • Chat
        • Agents
        • Tools
          • ES|QL tools
          • Index search tools
        • Programmatic access
          • Kibana APIs
          • A2A server
          • MCP server
        • Permissions & access control
        • Limitations & known issues
      • RAG
        • Playground
          • Optimize model context
          • View and modify queries
          • Troubleshooting
        • MCP servers
      • Add search to your app
        • Client libraries
        • Search UI
        • Search Applications
          • Search API and templates
          • Security
          • Search Application client guide
      • Cross-cluster search
        • Resolve a cluster before cross-cluster search
      • APIs and tools
      • AI Assistant
      • Query rules UI
    • Observability
      • Get started
        • Elastic Observability quickstarts
          • Quickstart: Monitor hosts with OpenTelemetry
          • Quickstart: Monitor your application performance
          • Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
          • Quickstart: Send OTLP data to Elastic Serverless or Elastic Cloud Hosted
          • Quickstart: Create a Synthetic Monitor
          • Quickstart: Monitor hosts with Elastic Agent
          • Quickstart: Monitor your Kubernetes cluster with Elastic Agent
          • Quickstart: Collect data with AWS Firehose
        • OpenTelemetry quickstarts
          • Self-managed
            • Kubernetes
            • Hosts / VMs
            • Docker
          • Elastic Cloud Serverless
            • Kubernetes
            • Hosts and VMs
            • Docker
          • Elastic Cloud Hosted
            • Kubernetes
            • Hosts and VMs
            • Docker
        • OpenTelemetry use cases
          • Kubernetes observability
            • Prerequisites and compatibility
            • Components description
            • Deployment
            • Instrumenting Applications
            • Upgrade
            • Customization
          • LLM observability
        • Other Observability tutorials
          • Tutorial: Monitor a Java application
        • Logs Essentials
      • Applications and services
        • Application performance monitoring (APM)
          • Get started with traces and APM
          • Application data types
            • Spans
            • Transactions
              • Transaction sampling
            • Traces
            • Errors
            • Metrics
            • Metadata
          • Collect application data
            • OpenTelemetry
              • Contrib OpenTelemetry Collectors and language SDKs
              • Collect metrics
              • Centrally configure EDOT SDKs
              • Limitations
              • Attributes and labels
              • Data stream routing
            • APM agents
              • Centrally configure APM agents
              • Real User Monitoring (RUM)
              • Create and upload source maps (RUM)
            • Kubernetes
            • AWS Lambda Functions
            • Jaeger (deprecated)
          • View and analyze data
            • Overviews
              • Services
              • Traces UI
              • Dependencies
              • Service Map
              • Service overview
              • Mobile service overview
            • Drill down into data
              • Transactions UI
              • Trace sample timeline
              • Errors UI
              • Metrics UI
              • Infrastructure
              • Logs
            • Filter and search data
              • Filters
              • Advanced queries
              • Cross-cluster search
            • Interpret data
              • Find transaction latency and failure correlations
              • Track deployments with annotations
              • Explore mobile sessions with Discover
              • Observe Lambda functions
            • Integrate with machine learning
            • APM Agent explorer
            • Settings
          • Act on data
            • Create rules and alerts
            • Create custom links
          • Use APM securely
            • Secure data
              • Control access to APM data
              • Built-in data filters
              • Custom filters
              • Delete sensitive data
            • Secure communication with APM agents
              • APM agent TLS communication
              • API keys
              • Secret token
              • Anonymous authentication
            • Secure communication with the Elastic Stack
              • Use feature roles
              • Grant access using API keys
            • Secure access to the Applications UI
              • Create an APM reader user
              • Create an annotation user
              • Create an API user
              • Create a central config user
              • Create a storage explorer user
          • Manage storage
            • Storage Explorer
            • Data streams
            • Index lifecycle management
            • View the Elasticsearch index template
            • Parse data using ingest pipelines
            • Storage and sizing guide
            • Reduce storage
            • Explore data in Elasticsearch
          • Work with APM Server
            • Set up
              • Fleet-managed APM Server
              • APM Server binary
            • Configure
              • General configuration options
              • Anonymous authentication
              • APM agent authorization
              • Configure APM Agent Central Configuration
              • Instrumentation
              • Kibana endpoint
              • Logging
              • Output
                • Elastic Cloud Hosted
                • Elasticsearch
                • Logstash
                • Kafka
                • Redis
                • Console
              • Project paths
              • Real User Monitoring (RUM)
              • SSL/TLS settings
                • SSL/TLS output settings
                • SSL/TLS input settings
              • Tail-based sampling
              • Use environment variables in the configuration
              • Advanced setup
                • Installation layout
                • Secrets keystore
                • Command reference
                • Tune data ingestion
                • High Availability
                • APM Server and systemd
            • Monitor
              • Fleet-managed
              • APM Server binary
                • Use internal collection
                • Use Metricbeat collection
                • Use local collection
          • APM APIs
            • APM UI API
            • APM Server API
              • APM Server information API
              • Elastic APM events intake API
              • Elastic APM agent configuration API
              • OpenTelemetry intake API
              • Jaeger event intake
            • Managed intake service event API
          • Upgrade
            • APM agent compatibility
            • Upgrade to version 9.0
              • Self-installation standalone
              • Self-installation APM integration
              • Elastic Cloud standalone
              • Elastic Cloud APM integration
            • Switch to the Elastic APM integration
              • Switch a self-installation
              • Switch an Elastic Cloud cluster
        • Synthetic monitoring
          • Get started
            • Use a Synthetics project
            • Use the Synthetics UI
          • Scripting browser monitors
            • Write a synthetic test
            • Configure individual monitors
            • Use the Synthetics Recorder
          • Configure lightweight monitors
          • Manage monitors
          • Work with params and secrets
          • Analyze monitor data
          • Monitor resources on private networks
          • Use the CLI
          • Configure a Synthetics project
          • Multi-factor Authentication
          • Configure Synthetics settings
          • Grant users access to secured resources
            • Setup role
            • Writer role
            • Reader role
          • Manage data retention
          • Use Synthetics with network security
          • Migrate from the Elastic Synthetics integration
          • Scale and architect a deployment
          • Synthetics support matrix
          • Synthetics Encryption and Security
        • Real user monitoring
        • LLM Observability
        • Uptime monitoring (deprecated)
          • Get started
          • Analyze
            • View monitor status
            • Analyze monitors
            • Inspect uptime duration anomalies
          • Configure settings
        • Visualize OTLP data
      • CI/CD
      • Cloud
        • AWS
          • Ingestion options
          • Monitor AWS with Elastic Agent
            • EC2
            • Kinesis data streams
            • S3
            • SQS
          • Monitor AWS with Beats
          • Monitor AWS with Amazon Data Firehose
            • VPC Flow Logs
            • CloudTrail logs
            • Network Firewall logs
            • WAF logs
            • CloudWatch logs
          • Monitor AWS with Elastic Serverless Forwarder
        • Azure
          • Monitor Microsoft Azure with Elastic Agent
          • Monitor Microsoft Azure with Beats
          • Monitor Microsoft Azure with the Azure Native ISV Service
          • Monitor Microsoft Azure OpenAI
        • GCP
          • GCP Dataflow templates
      • Infrastructure and hosts
        • Analyze infrastructure and host metrics
          • Get started with system metrics
          • View infrastructure metrics by resource type
          • Explore metrics data with Discover in Kibana
          • Explore infrastructure metrics over time
          • Analyze and compare hosts
          • Detect metric anomalies
          • Configure settings
        • Universal Profiling
          • Get started
          • Manage data storage
            • Index lifecycle management
            • Configure probabilistic profiling
          • Advanced configuration
            • Tag data for querying
            • Add symbols for native frames
            • Use a proxy
            • Override kernel version check
            • Environment variables to configure the Universal Profiling Agent
            • Configuration file of the Universal Profiling Agent
          • Upgrade
          • Self-hosted infrastructure
          • Install the backend
            • Step 1: Update the stack
            • Step 2: Enable Universal Profiling in Kibana
            • Step 3: Set up Universal Profiling in Kibana
            • Step 4: Run the backend applications
            • Step 5: Next steps
          • Operate the backend
        • Tutorial: Observe your Kubernetes deployments
        • Tutorial: Observe your nginx instances
          • Understanding "no results found" message
      • Logs
        • Get started with system logs
        • Send any log file using Elastic Agent
        • Send any log file using OTel Collector
        • Send application log data
          • Plaintext application logs
          • ECS formatted application logs
          • APM agent log sending
        • Parse and route logs
        • Filter and aggregate logs
        • Explore logs
          • Explore logs in Discover
          • Categorize log entries
          • Inspect log anomalies
        • Run a pattern analysis on log data
        • Configure log data sources
        • Add a service name to logs
        • Logs index template reference
          • Default logs index template
      • Streams
        • Manage data retention
        • Extract fields
          • Date processor
          • Dissect processor
          • Grok processor
          • Set processor
          • Rename processor
          • Append processor
          • Manual pipeline configuration
        • Partition data into child streams
        • Map fields
        • Manage data quality
        • Add significant events
        • Configure advanced settings
        • Wired streams
      • Incident management
        • Alerting
          • Create and manage rules
            • Anomaly detection
            • APM anomaly
            • Custom threshold
            • Degraded docs
            • Elasticsearch query
            • Error count threshold
            • Failed transaction rate threshold
            • Failed docs
            • Inventory
            • Latency threshold
            • Log threshold
            • Metric threshold
            • Monitor Status
            • TLS certificate
            • Uptime duration anomaly
            • SLO burn rate
          • Aggregation options
            • Rate aggregation
          • View and manage alerts
            • SLO burn rate breaches
            • Threshold breaches
        • Cases
          • Configure access to cases
          • Create and manage cases
          • Configure case settings
        • Service-level objectives (SLOs)
          • Configure SLO access
          • Create an SLO
      • Data set quality
      • AI Assistant
        • Connect to a local LLM
        • Large language model performance matrix
      • Serverless feature tiers
    • Security
      • Get started
        • Elastic Security quickstarts
          • Detect and respond to threats with SIEM
          • Protect your hosts with endpoint security
          • Secure your cloud assets with cloud security posture management
        • Elastic Security requirements
        • Elastic Security UI
        • Ingest data to Elastic Security
          • Enable threat intelligence integrations
          • Automatic migration
          • Automatic import
          • Content connectors
          • Agentless integrations
            • Cloud connector authentication for agentless
            • Agentless integrations FAQs
        • Spaces and Elastic Security
          • Spaces and Elastic Defend FAQ
        • Data views and Elastic Security
        • Create runtime fields in Elastic Security
        • Configure advanced settings
      • ES|QL for security
        • Tutorial: Threat hunting with ES|QL
      • AI for security
        • Elastic AI SOC Engine
          • Triage alerts
          • Upgrade from EASE to Elastic Security
        • AI Assistant
          • AI Assistant Knowledge Base
          • Use AI Assistant's Knowledge Base to improve response quality
        • Attack Discovery
        • Enable large language model (LLM) access
          • Large language model performance matrix
          • Connect to Azure OpenAI
          • Connect to Amazon Bedrock
          • Connect to OpenAI
          • Connect to Google Vertex
          • Connect to your own local LLM using LM Studio
          • Connect to your own LLM using vLLM (air gapped environments)
        • AI use cases
          • Triage alerts
          • Identify, investigate, and document threats
          • Generate, customize, and learn about ES|QL queries
        • Value report
      • Detections and alerts
        • Detections requirements
        • Using logsdb index mode with Elastic Security
        • About detection rules
        • Create a detection rule
          • Cross-cluster search and detection rules
          • Launch Timeline from investigation guides
          • Exclude cold and frozen data from individual rules
        • Use Elastic prebuilt rules
          • Update modified and unmodified Elastic prebuilt rules
        • Manage detection rules
        • Monitor rule executions
        • Rule exceptions
          • Create and manage value lists
          • Add and manage exceptions
          • Create and manage shared exception lists
        • About building block rules
        • MITRE ATT&CK® coverage
        • Manage detection alerts
          • Visualize detection alerts
          • View detection alert details
          • Add detection alerts to cases
          • Suppress detection alerts
        • Reduce notifications and alerts
        • Query alert indices
        • Tune detection rules
      • Configure endpoint protection with Elastic Defend
        • Elastic Defend requirements
        • Install Elastic Defend
          • Enable access on macOS
          • Deploy on macOS with MDM
          • Prevent Elastic Agent uninstallation
        • Elastic Defend feature privileges
        • Configure an integration policy for Elastic Defend
          • Configure updates for protection artifacts
          • Turn off diagnostic data for Elastic Defend
          • Configure self-healing rollback for Windows endpoints
          • Configure Linux file system monitoring
          • Configure data volume
          • Create an Elastic Defend policy using API
        • Configure offline endpoints and air-gapped environments
        • Uninstall Elastic Agent
      • Manage Elastic Defend
        • Endpoints
        • Policies
        • Trusted applications
        • Trusted devices
        • Event filters
        • Host isolation exceptions
        • Blocklist
        • Optimize Elastic Defend
        • Event capture and Elastic Defend
        • Endpoint protection rules
        • Automatic troubleshooting
        • Allowlist Elastic Endpoint in third-party antivirus apps
        • Elastic Endpoint self-protection features
      • Endpoint response actions
        • Automated response actions
        • Isolate a host
        • Response actions history
        • Third-party response actions
        • Configure third-party response actions
      • Cloud Security
        • Security posture management overview
        • Enable cloud security features in Serverless
        • Cloud security posture management
          • Get started with CSPM for AWS
          • Get started with CSPM for GCP
          • Get started with CSPM for Azure
          • CSPM privilege requirements
          • CSPM Findings
          • CSPM benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Kubernetes security posture management
          • Get started with KSPM
          • KSPM Findings
          • KSPM benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Cloud Asset Discovery
          • Set up Cloud Asset Discovery for AWS
          • Set up Cloud Asset Discovery for GCP
          • Set up Cloud Asset Discovery for Azure
        • Cloud native vulnerability management
          • Get started with CNVM
          • CNVM privilege requirements
          • CNVM Findings
          • CNVM dashboard
          • Frequently asked questions (FAQ)
        • Cloud workload protection for VMs
          • Capture environment variables
        • Ingest third-party cloud security data
          • CNCF Falco
          • AWS Security Hub
          • Wiz
          • Qualys VMDR
          • Tenable VM
          • Rapid7
          • AWS Config
          • AWS Inspector
          • Microsoft Defender for Cloud
          • Microsoft Defender for Endpoint
          • Microsoft Defender XDR
          • Google Security Command Center
      • Investigation tools
        • Timeline
          • Timeline templates
        • Visual event analyzer
        • Session View
        • Osquery
          • Osquery manager integration
          • Osquery FAQ
          • Add Osquery Response Actions
          • Run Osquery from investigation guides
          • Run Osquery from alerts
          • Examine Osquery results
          • Use placeholder fields in Osquery queries
        • Notes
        • Indicators of compromise
        • Cases
          • Cases requirements
          • Open and manage cases
          • Configure case settings
      • Dashboards
        • Overview dashboard
        • Detection & Response dashboard
        • Cloud Security Posture dashboard
        • Entity Analytics dashboard
        • Data Quality dashboard
        • Cloud Native Vulnerability Management Dashboard
        • Detection rule monitoring dashboard
        • Endpoint Detection and Response dashboard
      • Explore
        • Hosts page
        • Network page
          • Configure network map data
          • Configure the DNS histogram
        • Users page
      • Advanced Entity Analytics
        • Entity analytics overview
        • Entity risk scoring
          • Entity risk scoring requirements
          • Turn on the risk scoring engine
          • View entity details
          • Asset criticality
          • Entity store
          • View and analyze risk score data
        • Advanced behavioral detections
          • Machine learning job and rule requirements
          • Anomaly detection
          • Optimizing anomaly results
          • Behavioral detection use cases
        • Privileged user monitoring
          • Privileged user monitoring requirements
          • Set up privileged user monitoring
          • Monitor privileged user activities
      • Asset management
      • APIs
  • Manage data
    • The Elasticsearch data store
      • Index basics
        • Perform operations on indices
      • Near real-time search
      • Data streams
        • Set up a data stream
        • Use a data stream
        • Modify a data stream
        • Manage a data stream
        • Time series data streams
          • Quickstart
          • Set up a TSDS
          • Downsampling
            • Concepts
            • Configuration
            • Querying
          • Advanced topics
            • Time-bound indices
            • Reindex a TSDS
            • OTLP/HTTP endpoint
        • Logs data stream
        • Failure store
          • Using failure stores to address ingestion issues
      • Mapping
        • Dynamic mapping
          • Dynamic field mapping
          • Dynamic templates
        • Explicit mapping
        • Runtime fields
          • Map a runtime field
          • Define runtime fields in a search request
          • Override field values at query time
          • Retrieve a runtime field
          • Index a runtime field
          • Explore your data with runtime fields
        • Removal of mapping types
        • Update mapping API examples
      • Text analysis
        • Concepts
          • Anatomy of an analyzer
          • Index and search analysis
          • Stemming
          • Token graphs
        • Configure text analysis
          • Test an analyzer
          • Configuring built-in analyzers
          • Create a custom analyzer
          • Specify an analyzer
      • Templates
        • Simulate multi-component templates
        • Ignore missing component templates
      • Aliases
      • Manage data from the command line
    • Ingest: Bring your data to Elastic
      • Ingesting time series data
      • Ingesting data for Elastic solutions
      • Ingesting data from applications
        • Ingest data with Node.js
        • Ingest data with Python
        • Ingest data from Beats with Logstash as a proxy
        • Ingest data from a relational database
        • Ingest logs from a Python application using Filebeat
        • Ingest logs from a Node.js web application using Filebeat
      • Ingest architectures
        • Elastic Agent to Elasticsearch
          • Elastic Agent to Elasticsearch: Agent installed
          • Elastic Agent to Elasticsearch: APIs for collection
        • Elastic Agent to Logstash to Elasticsearch
          • Elastic Agent to Logstash (for enrichment) to Elasticsearch
          • Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering
          • Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy
          • Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations
        • Elastic Agent to proxy to Elasticsearch
        • Elastic Agent to Elasticsearch with Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Logstash to Elasticsearch: Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Kafka ES Sink to Elasticsearch: Kafka as middleware message queue
        • Logstash to Elasticsearch
        • Elastic air-gapped architectures
          • Elastic Agent to Elasticsearch: Air-gapped environment
          • Elastic Agent to Logstash: Air-gapped environment
      • Sample data
      • Upload data files
      • Transform and enrich data
        • Calculate the ingest lag metadata
        • Elasticsearch ingest pipelines
          • Example
          • Create readable and maintainable ingest pipelines
          • Error handling
        • Logstash pipelines
        • Data enrichment
          • Set up an enrich processor
          • Example: Enrich your data based on geolocation
          • Example: Enrich your data based on exact values
          • Example: Enrich your data by matching a value to a range
        • Index mapping and text analysis
      • Ingest tools overview
    • Data lifecycle
      • Data tiers
      • Index lifecycle management
        • Index lifecycle
        • About rollover
          • Skip rollover
        • Configure a lifecycle policy
        • Manually apply a policy to an index
        • View the lifecycle status of an index or data stream
        • Manage the lifecycle policy for integrations data
        • Update or switch a lifecycle policy
        • Start and stop ILM
        • Restore a managed data stream or index
        • ILM tutorials
          • Manage time series data with data streams
          • Manage time series data without data streams
          • Manage general content with data streams
          • Customize duplicates of built-in ILM policies
        • Migrate to ILM
          • Migrate to ILM (ECH or ECE)
          • Migrate to ILM (self-managed and ECK)
          • Migrate index allocation filters to node roles
      • Data stream lifecycle
        • Tutorial: Create a data stream with a lifecycle
        • Tutorial: Update the lifecycle of a data stream
        • Tutorial: Configure data stream retention
        • Tutorial: Migrate ILM managed data stream to data stream lifecycle
      • Curator
      • Rollup
        • Get started using the API
        • Get started in Kibana
        • Understanding groups
        • Rollup aggregation limitations
        • Rollup search limitations
        • Migrating to downsampling
    • Migrate your Elasticsearch data
      • Reindex from a self-managed cluster
      • Migrate system indices
      • Migrate with minimal downtime
    • Use case: Use Elasticsearch to manage time series data
  • Explore and analyze
    • Querying and filtering
      • Query languages
        • Query DSL
        • ES|QL
        • SQL
        • EQL
          • Example: Detect threats with EQL
        • KQL
        • Lucene query syntax
      • Query tools
        • Saved queries
        • Console
        • Search profiler
        • Grok debugger
        • Playground
      • Aggregations
        • Basics
      • Filtering in Kibana
    • Geospatial analysis
    • Transforming data
      • Overview
      • Setup
      • When to use transforms
      • Generating alerts for transforms
      • Transforms at scale
      • How checkpoints work
      • API quick reference
      • Tutorial: Transforming the eCommerce sample data
      • Examples
      • Painless examples
      • Limitations
    • Elastic Inference
      • Elastic Inference Service (EIS)
      • Inference integrations
    • Machine learning
      • Setup and security
      • Anomaly detection
        • Finding anomalies
          • Plan your analysis
          • Run a job
          • View the results
          • Forecast future behavior
        • Tutorial
        • Advanced concepts
          • Anomaly detection algorithms
          • Anomaly score explanation
          • Job types
          • Working with anomaly detection at scale
          • Handling delayed data
        • API quick reference
        • How-tos
          • Generating alerts for anomaly detection jobs
          • Aggregating data for faster performance
          • Altering data in your datafeed with runtime fields
          • Customizing detectors with custom rules
          • Detecting anomalous categories of data
          • Performing population analysis
          • Reverting to a model snapshot
          • Detecting anomalous locations in geographic data
          • Mapping anomalies by location
          • Adding custom URLs to machine learning results
          • Anomaly detection jobs from visualizations
          • Exporting and importing machine learning jobs
        • Resources
          • Limitations
          • Analysis function reference
          • Supplied configurations
          • Troubleshooting and FAQ
      • Data frame analytics
        • Overview
        • Finding outliers
        • Predicting numerical values with regression
        • Predicting classes with classification
        • Advanced concepts
          • How data frame analytics analytics jobs work
          • Working with data frame analytics at scale
          • Adding custom URLs to data frame analytics jobs
          • Feature encoding
          • Feature processors
          • Feature importance
          • Loss functions for regression analyses
          • Hyperparameter optimization
          • Trained models
        • API quick reference
        • Resources
          • Limitations
      • NLP
        • Overview
          • Extract information
          • Classify text
          • Search and compare text
        • Deploy trained models
          • Select a trained model
          • Import the trained model and vocabulary
          • Deploy the model in your cluster
          • Try it out
        • Add NLP inference to ingest pipelines
        • API quick reference
        • Built-in NLP models
          • ELSER
          • Elastic Rerank
          • E5
          • Language identification
        • Compatible third party models
        • Examples
          • End-to-end tutorial
          • Named entity recognition
          • Text embedding and semantic search
        • Limitations
      • ML in Kibana
        • AIOps Labs
        • Inference processing
    • Scripting
      • Painless
        • How to write Painless scripts
          • Write your first script
          • Use parameters
          • Shorten scripts
          • Store and retrieve scripts
          • Update documents using scripts
        • Painless script tutorials
          • Accessing document fields and special variables
          • Accessing fields in a document
          • Converting data types
          • Dissecting data
          • Extracing fields
          • Grokking grok
          • Scripts, caching, and search speed
          • Updating documents
          • Using Painless regular expressions
          • Working with dates
        • Painless syntax-context bridge
        • Scripting and security in Painless
        • Painless lab
      • Lucene expressions language
      • Implementing custom scripting language in Elasticsearch
    • AI assistants
    • Manage access to AI features
    • Discover
      • Explore fields and data with Discover
      • Customize the Discover view
      • Search for relevance
      • Save a search for reuse
      • View field statistics
      • Run a pattern analysis on your log data
      • Run queries in the background
      • Using ES|QL
    • Dashboards
      • Exploring dashboards
      • Building dashboards
        • Create a dashboard
        • Edit a dashboard
        • Add filter controls
        • Add drilldowns
        • Organize dashboard panels
        • Duplicate a dashboard
        • Import a dashboard
      • Managing dashboards
      • Sharing dashboards
      • Tutorials
        • Create a simple dashboard to monitor website logs
        • Create a dashboard with time series charts
    • Panels and visualizations
      • Supported chart types
      • Visualize Library
      • Manage panels
      • Lens
      • ES|QL
      • Custom visualizations with Vega
      • Text panels
      • Image panels
      • Link panels
      • Alert panels
      • Canvas
        • Edit workpads
        • Present your workpad
        • Tutorial: Create a workpad for monitoring sales
        • Canvas function reference
          • TinyMath functions
      • Maps
        • Build a map to compare metrics by country or region
        • Track, visualize, and alert on assets in real time
        • Map custom regions with reverse geocoding
        • Heat map layer
        • Tile layer
        • Vector layer
          • Vector styling
          • Vector style properties
          • Vector tooltips
        • Plot big data
          • Clusters
          • Display the most relevant documents per entity
          • Point to point
          • Term join
        • Search geographic data
          • Create filters from a map
          • Filter a single layer
          • Search across multiple indices
        • Configure map settings
        • Connect to Elastic Maps Service
        • Import geospatial data
          • Clean your data
          • Tutorial: Index GeoJSON data
        • Troubleshoot
      • Graph
        • Configure Graph
        • Troubleshooting and limitations
      • Legacy editors
        • Aggregation-based
        • TSVB
        • Timelion
    • Find and organize content
      • Data views
      • Saved objects
      • Files
      • Reports
      • Tags
      • Find apps and objects
    • Reporting and sharing
      • Automatically generate reports
      • Troubleshoot reporting
        • CSV
        • PDF/PNG
    • Alerts and cases
      • Alerts
        • Getting started with alerts
        • Set up
        • Create and manage rules
        • View and manage alerts
        • Rule types
          • Index threshold
          • Elasticsearch query
          • Tracking containment
        • Rule action variables
        • Notifications domain allowlist
        • Troubleshooting and limitations
          • Common issues
          • Event log index
          • Test connectors
        • Maintenance windows
      • Watcher
        • Getting started with Watcher
        • How Watcher works
        • Enable Watcher
        • Watcher UI
        • Encrypting sensitive data in Watcher
        • Inputs
          • Simple input
          • Search input
          • HTTP input
          • Chain input
        • Triggers
          • Schedule trigger
          • Throttling
          • Schedule Types
        • Conditions
          • Always condition
          • Never condition
          • Compare condition
          • Array compare condition
          • Script condition
        • Actions
          • Running an action for each element in an array
          • Adding conditions to actions
          • Email action
          • Webhook action
          • Index action
          • Logging action
          • Slack action
          • PagerDuty action
          • Jira action
        • Transforms
          • Search payload transform
          • Script payload transform
          • Chain payload transform
        • Managing watches
        • Example watches
          • Watching the status of an Elasticsearch cluster
          • Execute a watch
        • Limitations
      • Cases
        • Configure access to cases
        • Open and manage cases
        • Manage case settings
        • Use cases as data
    • Numeral formatting
  • Deploy and manage
    • Deploy
      • Detailed deployment comparison
      • Elastic Cloud
        • Compare Cloud Hosted and Serverless
        • Sign up
          • Subscribe from a marketplace
            • AWS Marketplace
            • Azure Native ISV Service
            • Google Cloud Platform Marketplace
            • Heroku
              • Install the add-on
                • Remove the add-on
              • Access the console
              • Work with Elasticsearch
              • Migrate between plans
              • Hardware
              • Regions
        • Elastic Cloud Serverless
          • Create a serverless project
          • Regions
          • Project settings
          • Manage projects with API
        • Elastic Cloud Hosted
          • Create an Elastic Cloud Hosted deployment
            • Available stack versions
          • Access Kibana
          • Plan for production
          • Manage deployments
            • Configure
              • Manage hardware profiles
                • Customize instance configuration
              • Customize deployment components
              • Edit Elastic Stack settings
              • Add plugins and extensions
                • Upload custom plugins and bundles
                • Manage plugins and extensions through the API
              • Custom endpoint aliases
            • Manage Integrations Server
              • Switch from APM to Integrations Server
            • Find your Cloud ID
          • vCPU boosting and credits
          • Manage deployments using the Elastic Cloud API
          • Keep track of deployment activity
          • Restrictions and known problems
        • Tools and APIs
      • Elastic Cloud Enterprise
        • Service-oriented architecture
        • Deploy an orchestrator
          • Prepare your environment
            • Hardware prerequisites
            • Software prerequisites
            • System configuration
            • Networking prerequisites
            • Users and permissions prerequisites
            • High availability
            • Separation of roles
            • Load balancers
            • JVM heap size
            • Wildcard DNS record and certificates
          • Install ECE
            • Identify the deployment scenario
            • Configure your operating system
              • Ubuntu
              • RHEL
              • SUSE
            • Installation procedures
              • Deploy a small installation
              • Deploy a medium installation
              • Deploy a large installation
              • Deploy using Podman
              • Migrate ECE to Podman hosts
                • Migrating to Podman 5
            • Post-installation steps
            • Install ECE on additional hosts
              • Manage roles tokens
            • Ansible playbook
            • Statistics collected by Elastic Cloud Enterprise
          • Air-gapped install
            • With your private Docker registry
            • Without a private Docker registry
            • Available Docker images
          • Configure ECE
            • Assign roles to hosts
            • System deployments configuration
              • Default system deployment versions
            • Manage deployment templates
              • Tag your allocators
              • Edit instance configurations
              • Create instance configurations
              • Create templates
              • Configure default templates
              • Configure index management
              • Data tiers and autoscaling support
              • Integrations server support
              • Default instance configurations
            • Change the ECE API URL
            • Change endpoint URLs
            • Enable custom endpoint aliases
            • Manage your allocators capacity
            • Configure allocator affinity
            • Change allocator disconnect timeout
            • Manage Elastic Stack versions
            • Include additional Kibana plugins
        • Log into the Cloud UI
        • Manage deployments
          • Deployment templates
          • Create a deployment
          • Access Kibana
          • Connect to Elasticsearch
          • Configure
            • Customize deployment components
            • Edit stack settings
              • Elasticsearch user settings
              • Kibana user settings
              • APM user settings
              • Enterprise search user settings
            • Resize deployment
            • Add plugins and extensions
            • Add custom bundles and plugins
            • Custom endpoint aliases
            • Resource overrides
            • Advanced cluster configuration
          • Search and filter deployments
          • Keep track of deployment activity
          • Manage Integrations Server
            • Enable Integrations Server through the API
            • Switch from APM to Integrations Server
        • Tools and APIs
      • Elastic Cloud on Kubernetes
        • Deploy an orchestrator
          • Install
            • YAML manifests
            • Helm chart
            • Required RBAC permissions
            • Deploy ECK on Openshift
              • Deploy the operator
              • Deploy an Elasticsearch instance with a route
              • Deploy a Kibana instance with a route
              • Deploy Docker images with anyuid SCC
              • Grant privileged permissions to Beats
              • Grant host access permission to Elastic Agent
            • Deploy ECK on GKE Autopilot
            • Deploy ECK on Google Distributed Cloud air-gapped
            • FIPS compatibility
          • Air-gapped environments
          • Configure
            • Apply configuration settings
            • Configure the validating webhook
            • Restrict cross-namespace resource associations
            • Service meshes
              • Istio
              • Linkerd
            • Webhook namespace selectors
        • Manage deployments
          • Deploy an Elasticsearch cluster
          • Deploy a Kibana instance
          • Elastic Stack Helm chart
          • Applying updates
          • Accessing services
          • Configure deployments
            • Elasticsearch configuration
              • Nodes orchestration
              • Storage recommendations
              • Node configuration
              • Volume claim templates
              • Virtual memory
              • Settings managed by ECK
              • Custom configuration files and plugins
              • Init containers for plugin downloads
              • Update strategy
              • Pod disruption budget
              • Advanced Elasticsearch node scheduling
              • Readiness probe
              • Pod PreStop hook
              • Security context
              • Requests routing to Elasticsearch nodes
            • Kibana configuration
              • Connect to an Elasticsearch cluster
              • Advanced configuration
              • Install Kibana plugins
            • Customize pods
            • Propagate labels and annotations
            • Manage compute resources
            • Recipes
            • Connect to external Elastic resources
            • Elastic Stack configuration policies
        • Orchestrate other Elastic applications
          • APM server
            • Use an Elasticsearch cluster managed by ECK
            • Advanced configuration
            • Connect to the APM Server
          • Standalone Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
          • Fleet-managed Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
            • Known limitations
          • Elastic Maps Server
            • Deploy Elastic Maps Server
            • Map data
            • Advanced configuration
            • Elastic Maps HTTP configuration
          • Beats
            • Quickstart
            • Configuration
            • Configuration examples
            • Troubleshooting
          • Logstash
            • Quickstart
            • Configuration
            • Securing Logstash API
            • Logstash plugins
            • Configuration examples
            • Update strategy
            • Advanced configuration
        • Create custom images
        • Tools and APIs
      • Self-managed cluster
        • Deploy an Elasticsearch cluster
          • Local installation (quickstart)
          • Important system configuration
            • Configure system settings
            • Disable swapping
            • Increase the file descriptor limit
            • Increase virtual memory
            • Increase max number of threads
            • Ensure JNA temporary directory permits executables
            • Decrease the TCP retransmission timeout
            • Bootstrap checks
          • Install on Linux or MacOS
          • Install on Windows
          • Install with Debian package
          • Install with RPM package
          • Install with Docker
            • Single-node cluster
            • Multi-node cluster
            • Production settings
            • Configure
        • Configure Elasticsearch
          • Important settings configuration
          • Add plugins
        • Install Kibana
          • Linux and MacOS
          • Windows
          • Debian
          • RPM
          • Docker
        • Configure Kibana
        • Access Kibana
        • Air gapped install
        • Tools and APIs
    • Distributed architecture
      • Clusters, nodes, and shards
        • Node roles
      • Reading and writing documents
      • Shard allocation, relocation, and recovery
        • Shard allocation awareness
        • Index-level shard allocation
          • Delaying allocation when a node leaves
      • The shard request cache
      • Discovery and cluster formation
        • Discovery
        • Quorum-based decision making
        • Voting configurations
        • Bootstrapping a cluster
        • Cluster state
        • Cluster fault detection
      • Kibana task management
    • Production guidance
      • Run Elasticsearch in production
        • Design for resilience
          • Resilience in small clusters
          • Resilience in larger clusters
          • Resilience in ECH and ECE
        • Scaling considerations
        • Performance optimizations
          • General recommendations
          • Tune for indexing speed
          • Tune for search speed
          • Tune approximate kNN search
          • Tune for disk usage
          • Size your shards
      • Run Kibana in production
        • High availability and load balancing
        • Configure memory
        • Manage background tasks
        • Traffic scaling considerations
        • Optimize alerting performance
        • Reporting production considerations
    • Reference architectures
      • Hot/Frozen - High Availability
    • Stack settings
    • Backup, high availability, and resilience tools
      • Snapshot and restore
        • Manage snapshot repositories
          • Self-managed
            • Azure repository
            • Google Cloud Storage repository
            • S3 repository
            • Shared file system repository
            • Read-only URL repository
            • Source-only repository
          • Elastic Cloud Hosted
            • AWS S3
            • Google Cloud Storage
            • Azure Blob Storage
            • Access isolation for the found-snapshots repository
              • Azure
              • AWS and GCP
          • Elastic Cloud Enterprise
            • AWS S3 repository
            • Google Cloud Storage
            • Azure Storage repository
            • MinIO self-managed repository
          • Elastic Cloud on Kubernetes
        • Create, monitor and delete snapshots
        • Restore a snapshot
          • Restore a snapshot across clusters
            • Restore snapshot into a new deployment
            • Restore snapshot into an existing deployment
            • Restore snapshots containing searchable snapshots indices across clusters
        • Searchable snapshots
      • Cross-cluster replication
        • Set up cross-cluster replication
          • Prerequisites
          • Connect to a remote cluster
          • Configure privileges for cross-cluster replication
          • Create a follower index to replicate a specific index
          • Create an auto-follow pattern to replicate time series indices
        • Manage cross-cluster replication
          • Inspect replication statistics
          • Pause and resume replication
          • Recreate a follower index
          • Terminate replication
        • Manage auto-follow patterns
          • Create auto-follow patterns
          • Retrieve auto-follow patterns
          • Pause and resume auto-follow patterns
          • Delete auto-follow patterns
        • Upgrading clusters
          • Uni-directional index following
          • Bi-directional index following
        • Uni-directional disaster recovery
          • Prerequisites
          • Failover when clusterA is down
          • Failback when clusterA comes back
        • Bi-directional disaster recovery
          • Initial setup
          • Failover when clusterA is down
          • Failback when clusterA comes back
          • Perform update or delete by query
    • Autoscaling
      • In ECE and ECH
      • In ECK
      • Autoscaling deciders
      • Trained model autoscaling
    • Cloud Connect
    • Security
      • Secure your orchestrator
        • Elastic Cloud Enterprise
          • Manage security certificates
          • Allow x509 Certificates Signed with SHA-1
          • Configure the TLS version
          • Migrate ECE on Podman hosts to SELinux enforce
        • Elastic Cloud on Kubernetes
      • Secure your cluster, deployment, or project
        • Self-managed security setup
          • Automatic security setup
          • Minimal security setup
          • Set up transport TLS
          • Set up HTTPS
          • Configure security in Kibana
        • Manage TLS encryption
          • Self-managed
            • Update TLS certificates
              • With the same CA
              • With a different CA
            • Mutual authentication
            • Supported SSL/TLS versions by JDK version
            • Enabling cipher suites for stronger encryption
          • ECK
            • Manage HTTP certificates on ECK
            • Manage transport certificates on ECK
        • Network security
          • How network security policies work in Cloud
          • How IP filtering rules work in ECE
          • Add IP filters
            • In ECH or Serverless
            • In ECE
            • In ECK and Self Managed
          • Remote cluster filters
          • Private connectivity
            • AWS PrivateLink
            • Azure Private Link
            • GCP Private Service Connect
            • Claim private connection ownership
          • Through the API
          • Kubernetes network policies
        • Elastic Cloud Static IPs
        • Kibana session management
        • Encrypt your deployment data
          • Use a customer-managed encryption key
        • Secure your settings
          • Secure settings on ECK
        • Secure Kibana saved objects
        • Security event audit logging
          • Enable audit logging
          • Configure audit logging
            • Elasticsearch audit events ignore policies
            • Elasticsearch logfile output
          • Audit Elasticsearch search queries
          • Correlate audit events
      • Secure other Elastic Stack components
      • Securing HTTP client applications
      • Limitations
      • FIPS 140-2 compliance
        • FIPS compliance for Elasticsearch
        • FIPS compliance for Kibana
        • FIPS mode for Ingest tools
    • Users and roles
      • Cloud organization
        • Manage users
        • User roles and privileges
        • Configure SAML SSO
          • Okta
          • Microsoft Entra ID
      • ECE orchestrator
        • Manage system passwords
        • Manage users and roles
          • Native users
          • Active Directory
          • LDAP
          • SAML
        • Configure SSO for deployments
      • Serverless project custom roles
      • Cluster or deployment
        • Quickstart
        • User authentication
          • Authentication realms
            • Realm chains
            • Security domains
          • Internal authentication
            • Native
            • File-based
          • External authentication
            • Active Directory
            • JWT
            • Kerberos
            • LDAP
            • OpenID Connect
              • With Azure, Google, or Okta
            • SAML
              • With Microsoft Entra ID
            • PKI
            • Custom realms
          • Built-in users
            • Change passwords
          • Orchestrator-managed users
            • ECH and ECE
            • ECK managed credentials
          • Kibana authentication
          • Kibana access agreement
          • Anonymous access
          • Token-based authentication services
          • Service accounts
          • Internal users
          • Operator privileges
            • Configure operator privileges
            • Operator-only functionality
            • Operator privileges for snapshot and restore
          • User profiles
          • Looking up users without authentication
          • Controlling the user cache
          • Manage authentication for multiple clusters
        • User roles
          • Built-in roles
          • Defining roles
            • Role structure
            • For data streams and aliases
            • Using Kibana
            • Role restriction
          • Elasticsearch privileges
          • Kibana privileges
          • Map users and groups to roles
            • Role mapping properties
          • Authorization delegation
          • Authorization plugins
          • Control access at the document and field level
          • Submit requests on behalf of other users
    • Spaces
      • Using Spaces with Fleet
    • API keys
      • Elasticsearch API keys
      • Serverless project API keys
      • Elastic Cloud API keys
      • Elastic Cloud Enterprise API keys
    • Connectors
    • Remote clusters
      • Security models
      • Connection modes
      • On Elastic Cloud Hosted
        • To the same Elastic Cloud organization
        • To a different Elastic Cloud organization
        • To Elastic Cloud Enterprise
        • To a self-managed cluster
        • To Elastic Cloud on Kubernetes
        • Manage trusted environments
        • Migrate from the CCS deployment template
      • On Elastic Cloud Enterprise
        • To the same ECE environment
        • To a different ECE environment
        • To Elastic Cloud
        • To a self-managed cluster
        • To Elastic Cloud on Kubernetes
        • Manage trusted environments
        • Migrate from the CCS deployment template
      • On self-managed Elastic Stack
        • Add remote clusters using API key authentication
        • Add remote clusters using TLS certificate authentication
        • Migrate from certificate to API key authentication
      • On Elastic Cloud on Kubernetes
    • Monitoring
      • AutoOps
        • For Elastic Cloud Hosted
        • For Elastic Cloud Serverless
          • Access AutoOps in your project
          • Search Tier view
          • Search AI Lake view
        • For self-managed clusters
          • Connect your self-managed cluster
          • Connect your local development cluster
          • Configure Elastic agent with custom certificate
          • Manage connected cluster users
          • Troubleshooting
            • Firewalls blocking Elastic Agent
        • Regions
        • Views
          • Overview
          • Deployment or Cluster
          • Nodes
          • Indices
          • Shards
          • Template Optimizer
        • Events
          • Event Settings
          • Notifications Settings
        • FAQ
      • Stack monitoring
        • Enable on ECH and ECE
        • Enable on ECK
        • Self-managed: Elasticsearch
          • Collecting monitoring data with Elastic Agent
          • Collecting monitoring data with Metricbeat
          • Collecting log data with Filebeat
          • Monitoring in a production environment
          • Legacy collection methods
            • Collectors
            • Exporters
            • Local exporters
            • HTTP exporters
            • Pausing data collection
        • Self-managed: Kibana
          • Collect monitoring data with Elastic Agent
          • Collect monitoring data with Metricbeat
          • Legacy collection methods
        • Access monitoring data in Kibana
        • Visualizing monitoring data
          • Beats metrics
          • Elasticsearch metrics
          • Kibana metrics
          • Logstash metrics
          • Troubleshooting
        • Stack monitoring alerts
        • Configuring monitoring data streams and indices
          • Configuring data streams created by Elastic Agent
          • Configuring data streams created by Metricbeat 8
          • Configuring indices created by Metricbeat 7 or internal collection
      • AutoOps vs. Stack Monitoring
      • Cloud deployment health
        • Performance metrics on Elastic Cloud
        • JVM memory pressure indicator
      • Kibana task manager monitoring
      • Monitoring orchestrators
        • ECK operator metrics
          • Enabling the metrics endpoint
          • Securing the metrics endpoint
          • Prometheus requirements
        • ECE platform monitoring
          • Platform monitoring deployment logs and metrics
          • Proxy log fields
          • Set the retention period for logging and metrics indices
      • Logging
        • Elasticsearch log4j configuration
        • Update Elasticsearch logging levels
        • Elasticsearch deprecation logs
        • Kibana logging
          • Set global log levels for Kibana
          • Advanced Kibana logging settings
            • Examples
    • Configure Kibana reporting
    • Manage your Cloud organization
      • Billing
        • Hosted billing dimensions
        • Serverless billing dimensions
          • Elasticsearch projects
          • Observability projects
          • Security projects
        • Billing models
        • Add your billing details
        • View your billing history
        • Manage your subscription
        • Monitor and analyze usage
        • Elastic Consumption Units
        • Billing FAQ
      • Operational emails
      • Update billing and operational contacts
      • Service status
      • Tools and APIs
    • Licenses and subscriptions
      • Elastic Cloud Enterprise
      • Elastic Cloud on Kubernetes
      • Self-managed cluster
    • Maintenance
      • ECE maintenance
        • Deployments maintenance
          • Pause instance
        • Maintenance activities
          • Enable maintenance mode
          • Scale out your installation
          • Move nodes or instances from allocators
          • Perform ECE hosts maintenance
          • Delete ECE hosts
      • Start and stop services
        • Start and stop Elasticsearch
        • Start and stop Kibana
        • Restart an Elastic Cloud Hosted deployment
        • Restart an ECE deployment
        • Full Cluster restart and rolling restart procedures
      • Start and stop routing requests
      • Add and Remove Elasticsearch nodes
    • Upgrade
      • Plan your upgrade
      • Preparation steps
        • Upgrade Assistant
      • Upgrade your deployment or cluster
        • Upgrade from 7.17 to 9.2.1
        • Upgrade on Elastic Cloud Hosted
        • Upgrade on Elastic Cloud Enterprise
        • Upgrade on Elastic Cloud on Kubernetes
        • Upgrade Elastic on a self-managed cluster
          • Upgrade Elasticsearch
            • Archived settings
            • Reading indices from older Elasticsearch versions
          • Upgrade Kibana
            • Saved object migrations
            • Roll back to a previous version
        • Upgrade Enterprise Search
      • Upgrade your ingest components
      • Upgrade your ECE or ECK orchestrator
        • Upgrade Elastic Cloud Enterprise
          • Re-running the ECE upgrade
        • Upgrade Elastic Cloud on Kubernetes
    • Uninstall
      • Uninstall Elastic Cloud Enterprise
      • Uninstall Elastic Cloud on Kubernetes
      • Delete an orchestrated deployment
  • Manage your Cloud account and preferences
    • Join or leave an organization
    • Update your email address
    • Change your password
    • Add a login method
    • Multifactor authentication
    • Use dark mode in Kibana
    • Use high-contrast mode in Kibana
  • Troubleshoot
    • Elasticsearch
      • Clusters
        • Common cluster issues
          • Watermark errors
          • Circuit breaker errors
          • High CPU usage
          • High JVM memory pressure
          • Red or yellow health status
          • Rejected requests
          • Task queue backlog
          • Mapping explosion
          • Hot spotting
        • Unstable clusters
        • Unbalanced clusters
        • Remote clusters
        • Unassigned shards
        • Shard capacity issues
        • Cluster allocation API examples
      • Data
        • Data allocation
        • Index allocation
        • Preferred data tier
        • Incomplete migration to data tiers
        • Not enough nodes to allocate shard replicas
        • Total number of shards for an index exceeded
        • Total number of shards per node reached
        • Data corruption
        • Ingest Pipelines
      • Capacity
        • Data nodes out of disk
          • Increase disk capacity
          • Decrease disk usage
        • Master nodes out of disk
        • Other nodes out of disk
      • Snapshot and restore
        • Restore from snapshot
        • Broken repositories
          • Corrupted repositories
          • Unknown repositories
          • Invalid repositories
        • Snapshot policy failures
      • Searches
      • Lifecycle management
      • Index lifecycle management errors
      • File-based access recovery
      • Security
        • Nodes info API response
        • Authorization errors
        • Error: Extra arguments provided
        • Active Directory
        • Certificate verification with curl on Mac
        • SSLHandshakeException
        • SSL/TLS exceptions
        • Kerberos
        • SAML
        • Kibana internal server error
        • Password setup failures
        • Configuration file locations
        • Error: Token invalid or expired
      • Error reference
        • Error: All shards failed
        • Error: Failed to parse field of type in document with id
        • Error: Unable to retrieve node fs stats
        • Error: Unable to parse response body
      • Clients
      • Diagnostics
      • More topics
        • Discovery
        • Monitoring
        • Transforms
        • Watcher
        • Apache Hadoop
    • Kibana
      • Server logs
      • Server status
      • Error: Server not ready
      • Trace Elasticsearch query
      • Monitoring
      • Alerts
      • Reporting
      • Task Manager
      • Maps
      • Graph
      • Migration and upgrades
      • Diagnostics
    • Observability
      • Explore data
      • Inspect
      • Synthetics
      • Uptime
      • Logs
      • APM
        • Common problems
        • APM Server or Elasticsearch is down
        • APM Server response codes
        • Processing and performance
        • APM Server binary debugging
        • APM Server performance diagnostic
        • APM Go Agent
        • APM Java Agent
        • APM .NET agent
        • APM Node.js Agent
        • APM PHP Agent
          • Agent is not instrumenting code
          • Collection of diagnostic information
        • APM Python Agent
        • APM Ruby Agent
        • APM Real User Monitoring JavaScript Agent
      • Amazon Data Firehose
      • Universal Profiling
        • Troubleshoot the backend
      • Infrastructure monitoring
        • Understand "no results found" message
      • SLOs
    • Security
      • Detection rules
      • Elastic Defend
      • Indicators of compromise
      • Troubleshoot agentless integrations
    • Ingest tools
      • Elastic Distributions of OpenTelemetry (EDOT)
        • EDOT Collector
          • Collector out of memory
          • Insufficient resources with Kube-Stack chart
          • Collector doesn’t propagate metadata
          • Enable debug logging
          • Collector doesn't start
          • Collector sampling issues
          • Export errors from the EDOT Collector
        • EDOT SDKs
          • EDOT Android
          • EDOT .NET
          • EDOT iOS
          • EDOT Java
            • Proxy issues
          • EDOT Node.js
          • EDOT PHP
          • EDOT Python
          • Enable debug logging for SDKs
          • No app-level telemetry in Kibana
          • Proxy settings
          • SDK sampling issues
        • No data visible in Kibana
        • Connectivity issues
        • 429 errors when using the mOTLP endpoint
        • Contact support
      • Logstash
        • Plugins
          • Kafka
          • Azure Event Hub
        • Health report pipelines
        • Contribute and discuss
        • Diagnostics
      • Fleet and Elastic Agent
        • Common problems
        • Frequently asked questions
      • Elastic Logging Plugin for Docker
      • Elastic Serverless Forwarder
    • Elastic Cloud
      • Serverless status
      • SAML single sign-on (SSO)
      • Unavailable nodes
      • Unavailable shards
      • Performance
        • High memory pressure
        • Cluster performance metrics
        • Cluster response time
      • Node moves and system maintenance
      • Deployment health warnings
      • Node bootlooping
    • Elastic Cloud Enterprise
      • Common problems
      • Emergency roles token
      • Removing containers
      • Container engines
      • ZooKeeper sync status
      • Zookeeper quorum
      • Deployment health warnings
      • Node bootlooping
      • Diagnostics
      • Heap dumps
      • Thread dumps
    • Elastic Cloud on Kubernetes
      • Common issues
      • Resources and logs
      • Diagnostics
      • JVM heap dumps
  • Release notes
    • Release notes
    • Elasticsearch Clients
    • Elastic Observability
      • Known issues
      • Breaking changes
      • Deprecations
    • Elastic APM agents
    • Elastic Security
      • Known issues
      • Breaking changes
      • Deprecations
    • Elastic Cloud Serverless
      • Breaking changes
      • Known issues
      • Deprecations
  • Reference
    • Security
      • Fields and object schemas
        • Elastic Security ECS field reference
        • Timeline schema
        • Alert schema
      • Endpoint command reference
      • Elastic Defend advanced settings
    • Observability
      • Fields and object schemas
      • Infrastructure metrics reference
        • Host metrics
        • Container metrics
        • Kubernetes pod metrics
        • AWS metrics
    • Clients
    • Ingestion tools
    • Fleet and Elastic Agent
      • Restrictions for Elastic Cloud Serverless
      • Beats and Elastic Agent capabilities
      • Migrate from Beats to Elastic Agent
        • Migrate from Auditbeat to Elastic Agent
      • Deployment models
        • What is Fleet Server?
        • Deploy on Elastic Cloud
        • Deploy on-premises and self-managed
        • Deploy Fleet Server on-premises and Elasticsearch on Cloud
        • Deploy Fleet Server on Kubernetes
        • Fleet Server scalability
        • Fleet Server Secrets
          • Secret files guide
        • Monitor a self-managed Fleet Server
      • Install Elastic Agents
        • Elastic Agent release process
        • Install Fleet-managed Elastic Agents
        • Install standalone Elastic Agents
          • Upgrade standalone Elastic Agents
        • Install Elastic Agents in a containerized environment
          • Run Elastic Agent in a container
          • Run Elastic Agent on Kubernetes managed by Fleet
          • Install Elastic Agent on Kubernetes using Helm
            • Example: Install standalone Elastic Agent on Kubernetes using Helm
            • Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm
          • Advanced Elastic Agent configuration managed by Fleet
          • Configuring Kubernetes metadata enrichment on Elastic Agent
          • Run Elastic Agent on GKE managed by Fleet
          • Configure Elastic Agent Add-On on Amazon EKS
          • Run Elastic Agent on Azure AKS managed by Fleet
          • Run Elastic Agent Standalone on Kubernetes
          • Scaling Elastic Agent on Kubernetes
          • Using a custom ingest pipeline with the Kubernetes Integration
          • Environment variables
        • Run Elastic Agent as an EDOT Collector
        • Transform an installed Elastic Agent to run as an EDOT Collector
        • Run Elastic Agent without administrative privileges
        • Install Elastic Agent from an MSI package
        • Installation layout
        • Air-gapped environments
        • Using a proxy server with Elastic Agent and Fleet
          • When to configure proxy settings
          • Proxy Server connectivity using default host variables
          • Fleet managed Elastic Agent connectivity using a proxy server
          • Standalone Elastic Agent connectivity using a proxy server
          • Set the proxy URL of the Elastic Package Registry
        • Uninstall Elastic Agents from edge hosts
        • Start and stop Elastic Agents on edge hosts
        • Elastic Agent configuration encryption
      • Secure connections
        • Configure SSL/TLS for self-managed Fleet Servers
        • Rotate SSL/TLS CA certificates
        • Elastic Agent deployment models with mutual TLS
        • One-way and mutual TLS certifications flow
        • Configure SSL/TLS for the Logstash output
      • Manage Elastic Agents in Fleet
        • Fleet settings
          • Elasticsearch output settings
          • Logstash output settings
          • Kafka output settings
          • Remote Elasticsearch output
            • Automatic integrations synchronization
          • Considerations when changing outputs
        • Elastic Agents
          • Unenroll Elastic Agents
          • Set inactivity timeout
          • Upgrade Elastic Agents
          • Migrate Elastic Agents
          • Monitor Elastic Agents
          • Elastic Agent health status
          • Add tags to filter the Agents list
          • Enrollment handling for containerized agents
        • Policies
          • Create an agent policy without using the UI
          • Enable custom settings in an agent policy
          • Set environment variables in an Elastic Agent policy
        • Roles and privileges
        • Fleet enrollment tokens
        • Kibana Fleet APIs
      • Configure standalone Elastic Agents
        • Create a standalone Elastic Agent policy
        • Structure of a config file
        • Inputs
          • Simplified log ingestion
          • Elastic Agent inputs
          • Variables and conditions in input configurations
        • Outputs
          • Elasticsearch
          • Kafka
          • Logstash
        • SSL/TLS
        • Logging
        • Feature flags
        • Agent download
        • Config file examples
          • Apache HTTP Server
          • Nginx HTTP Server
        • Grant standalone Elastic Agents access to Elasticsearch
        • Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
        • Example: Use standalone Elastic Agent with Elastic Cloud Hosted to monitor nginx
        • Debug standalone Elastic Agents
        • Kubernetes autodiscovery with Elastic Agent
          • Conditions based autodiscover
          • Hints annotations based autodiscover
        • Monitoring
        • Reference YAML
      • Manage integrations
        • Package signatures
        • Add an integration to an Elastic Agent policy
        • View integration policies
        • Edit or delete an integration policy
        • Install and uninstall integration assets
        • View integration assets
        • Set integration-level outputs
        • Upgrade an integration
        • Roll back an integration
        • Managed integrations content
        • Best practices for integration assets
        • OpenTelemetry integration packages
        • Data streams
          • Tutorials: Customize data retention policies
            • Scenario 1
            • Scenario 2
            • Scenario 3
            • Scenario 4
          • Tutorial: Transform data with custom ingest pipelines
          • Advanced data stream features
        • Built-in alerts and templates
      • Command reference
      • Agent providers
        • Local provider
        • Agent provider
        • Host provider
        • Env provider
        • Filesource provider
        • Kubernetes Secrets provider
        • Kubernetes LeaderElection Provider
        • Local dynamic provider
        • Docker provider
        • Kubernetes provider
      • Agent processors
        • Processor syntax
        • add_cloud_metadata
        • add_cloudfoundry_metadata
        • add_docker_metadata
        • add_fields
        • add_host_metadata
        • add_id
        • add_kubernetes_metadata
        • add_labels
        • add_locale
        • add_network_direction
        • add_nomad_metadata
        • add_observer_metadata
        • add_process_metadata
        • add_tags
        • community_id
        • convert
        • copy_fields
        • decode_base64_field
        • decode_cef
        • decode_csv_fields
        • decode_duration
        • decode_json_fields
        • decode_xml
        • decode_xml_wineventlog
        • decompress_gzip_field
        • detect_mime_type
        • dissect
        • dns
        • drop_event
        • drop_fields
        • extract_array
        • fingerprint
        • include_fields
        • move_fields
        • parse_aws_vpc_flow_log
        • rate_limit
        • registered_domain
        • rename
        • replace
        • script
        • syslog
        • timestamp
        • translate_sid
        • truncate_fields
        • urldecode
    • APM
      • APM settings
      • APM settings for Elastic Cloud
      • APM settings for Elastic Cloud Enterprise
    • APM agents
    • Machine learning
      • Kibana anomaly detection job wizards
        • Apache anomaly detection configurations
        • APM anomaly detection configurations
        • Auditbeat anomaly detection configurations
        • Logs anomaly detection configurations
        • Metricbeat anomaly detection configurations
        • Metrics anomaly detection configurations
        • Nginx anomaly detection configurations
        • Security anomaly detection configurations
        • Uptime anomaly detection configurations
      • ML function reference
        • Count functions
        • Geographic functions
        • Information content functions
        • Metric functions
        • Rare functions
        • Sum functions
        • Time functions
    • Glossary
  • Contribute to the docs
    • Contribute on the web
    • Contribute locally
    • Syntax quick reference
    • How-to guides
      • Write cumulative documentation
        • Guidelines
        • Badge usage and placement
        • Example scenarios
        • Quick reference
    • Tools
      • Elastic Docs Utilities extension
      • Vale linter
    • Contribute to API docs
      • How Elastic API docs work
      • Checklist
      • Add core content
      • Organize and annotate docs
      • Quickstarts
        • Elasticsearch API docs
        • Kibana API docs
      • API docs by product
      • Report issues and get help
    • Contribute to Asciidoc docs
  • Extend and contribute
  • Documentation archive
  • Elastic documentation versions
  • View as Markdown
  • Report a docs issue
  • Edit this page
  • Learn how to contribute
Loading
  1. Elastic Docs /
  2. Reference /
  3. Observability

Infrastructure metrics reference

Learn about the key metrics displayed in the Infrastructure app and how they are calculated.

  • Host metrics
  • Container metrics
  • Kubernetes pod metrics
  • AWS metrics
Previous
Fields and object schemas
Next
Host metrics
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2025 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.