Elasticsearch On-Prem

​

Overview

​

Prerequisites

• Access to your self-hosted Elasticsearch cluster
• Ability to create API keys in Elasticsearch
• Network connectivity between TierZero and your Elasticsearch cluster (port 9200 over HTTPS)

​

Setup Instructions

​

Step 1: Navigate to Integration Settings

1. Log into your TierZero dashboard
2. Go to Settings → Integrations
3. Click Connect next to Elasticsearch

​

Step 2: Create an API Key

1. Open Stack Management → API Keys
2. Click Create API Key
3. Name it (e.g., “tierzero-read-access”)
4. Set read-only permissions:

{
  "role_descriptors": {
    "tierzero_reader": {
      "cluster": ["monitor"],
      "index": [
        {
          "names": ["*"],
          "privileges": ["read", "view_index_metadata"]
        }
      ]
    }
  }
}

5. Click Create and copy the Base64-encoded API key

curl -X POST "https://<your-elasticsearch-host>:9200/_security/api_key" \
  -H "Content-Type: application/json" \
  -u "elastic:<password>" \
  -d '{
    "name": "tierzero-read-access",
    "role_descriptors": {
      "tierzero_reader": {
        "cluster": ["monitor"],
        "index": [
          {
            "names": ["*"],
            "privileges": ["read", "view_index_metadata"]
          }
        ]
      }
    }
  }'

​

Step 3: Enter Connection Details

1. Enter your Elasticsearch cluster endpoint (e.g., https://elasticsearch.internal.yourcompany.com:9200)
2. Paste the Base64-encoded API key
3. Click Connect

​

Network Requirements

• Port: 9200 (default) or your custom Elasticsearch port
• Protocol: HTTPS with a valid TLS certificate
• If your cluster is behind a firewall or VPN, ensure TierZero’s IP addresses are allowlisted
• For clusters in AWS, AWS PrivateLink is supported. Contact TierZero to set up a private connection without exposing your cluster to the public internet

​

What TierZero Accesses

• Log search: Query logs across indices with time range filtering
• Index metadata: Index names and field mappings
• Aggregations: Statistical analysis of log data
• Cluster health: Basic cluster monitoring status

​

Security

• TierZero uses API key authentication with read-only permissions
• No write, delete, or admin operations are performed
• API keys are encrypted at rest and in transit
• Revoke access by deleting the API key in your Elasticsearch cluster
• Never store credentials in plaintext in configuration files or source control

​

Troubleshooting

​

Connection Timeout

• Verify the cluster endpoint is reachable from TierZero (check firewall rules)
• Ensure HTTPS is enabled on your Elasticsearch cluster
• Confirm the port number is correct

​

Authentication Errors

• Verify the API key is Base64-encoded (the encoded value from the creation response)
• Check that the API key has not expired
• Ensure the API key has the required read and monitor permissions

​

TLS Certificate Errors

• Ensure your Elasticsearch cluster has a valid TLS certificate
• Self-signed certificates may require additional configuration