Elastic Managed integrations FAQ
Frequently asked questions about Elastic Managed integrations.
Elastic Managed integrations are best suited for integrations that pull data from a cloud source through an API at lower volumes. For a complete list, refer to Elastic Managed integrations quick reference. Elastic continually adds more integrations to this list.
Not every integration in Elastic's catalog can run as an Elastic Managed integration. Only integrations that pull data from a cloud source through an API can be made available in this mode. To request that an integration be made available, open an enhancement request in the elastic/integrations repository.
You can deploy up to 50 Elastic Managed integrations per Serverless project or Elastic Cloud Hosted deployment.
Yes. Data ingested through Elastic Managed integrations lands in your cluster like any other integration data, so all Elasticsearch and Kibana features apply — including alerting.
On Serverless projects, you can deploy Elastic Managed integrations at no additional cost.
On Elastic Cloud Hosted, each deployed Elastic Managed integration is charged per hour. On the Elastic price list, the unit appears as [csp].managed-integration, where [csp] is aws, azure, or gcp.
Most Elastic Managed integrations are metered at one unit per integration, per hour. The following integrations are exceptions:
| Integration | Unit cost (per integration, per hour) |
|---|---|
| Microsoft Defender XDR Logs | 4 |
| Microsoft Defender for Endpoint | 4 |
| Rapid7 InsightVM logs | 4 |
| CrowdStrike Falcon Intelligence logs | 4 |
| abuse.ch API | 2 |
For current pricing details, refer to the Elastic pricing page.
In these versions, Elastic Managed integrations are in technical preview and are free on Elastic Cloud Hosted.
Elastic Managed integrations run on Elastic-managed infrastructure that Elastic operates as part of Elastic Cloud Serverless. As a result, the service follows the Elastic Cloud Serverless SLA, whether the data it collects lands in an Elastic Cloud Serverless project or an Elastic Cloud Hosted deployment.
In these versions, Elastic Managed integrations are in technical preview and are provided as-is, so no SLA applies.
Documents ingested through Elastic Managed integrations are stored in your project or Elastic Cloud Hosted deployment, the same as data ingested by agent-based integrations.
Usually not. Data flows from Elastic-managed infrastructure to your cluster over Elastic's internal network. However, if your Elastic Cloud Hosted deployment is in a region that isn't served by Elastic Cloud Serverless, data might traverse the public internet to reach your cluster.
Elastic employees don't have access to data in your project or deployment. Data ingested through Elastic Managed integrations is stored in your cluster, with the same access controls as data ingested by any other method.
No. Elastic Managed integrations run on shared infrastructure and don't use a fixed range of IP addresses for ingress or egress.
Yes. Elastic Managed integrations support traffic filtering, and no additional configuration is necessary.
Yes. To ensure a consistent level of service and avoid issues caused by under-resourced clusters, each Elastic Managed integration is limited to 300 events per second (EPS). If throughput spikes above this limit, the service is throttled, and the UI shows when this happens. Continuously hitting this limit delays ingestion of your cloud data source. If you need higher throughput, consider the Elastic Distribution of OpenTelemetry Cloud Forwarder.
No. Deploying multiple Elastic Managed integrations for the same source doesn't increase ingest throughput. For higher throughput, consider the Elastic Distribution of OpenTelemetry Cloud Forwarder.
For an isolated issue with a single collector, Elastic restarts it and ingestion resumes. Any events in the collector's in-memory queue might be lost. For a service-wide outage, no data is collected until the infrastructure recovers, and some in-flight events might be lost.
Elastic Managed integrations are a fully managed service, so the underlying collectors aren't shown in Fleet — Elastic operates the infrastructure on your behalf. You can still view each integration's status in the Integrations app and observe the ingested data itself in your cluster.
Manage and monitor Elastic Managed integrations from the Integrations app:
- In Kibana, find Integrations in the navigation menu or use the global search field.
- Do one of the following:
- Open the Installed integrations tab and select View policies for the integration you want.
- Open the integration's page and go to its Integration policies tab.
Each integration policy shows the integration's status, so you can check its health and take action — such as updating credentials — without using Fleet.
Elastic Managed integrations are a managed service, so you monitor their health at the integration level rather than by managing the underlying infrastructure yourself. The exact steps to check and resolve an unhealthy integration depend on your version:
Each integration's status appears on its Integration policies tab in the Integrations app.
If an Elastic Managed integration is unhealthy:
- Check why it's unhealthy. Hover over the integration's status on its Integration policies tab to see a full breakdown of why the integration is unhealthy.
- Check your credentials and configuration. Most issues are caused by expired or invalid credentials, or by missing permissions at the source. Edit the integration to update its credentials or configuration.
- Contact Elastic Support if the problem persists. You don't need to inspect or debug the collector yourself — Elastic operates it for you, monitors the service, and can collect diagnostics on your behalf.
A healthy status means the integration is connected and ready, but it doesn't necessarily mean data is currently flowing. If an integration is healthy but you don't see data, confirm that the source has data available and check the integration's throughput. If data still doesn't appear, contact Elastic Support.
In these versions, the underlying collectors are hidden in Fleet by default, so first make them visible.
On the Fleet → Agents page, collectors associated with Elastic Managed integrations have names that begin with agentless. When a collector is Unhealthy:
- Check the integration configuration. Most
Unhealthystates are caused by expired or invalid credentials, or by source-side permission issues. Confirm that the credentials and configuration you provided for the integration are still valid. - Contact Elastic Support. If the configuration looks correct but the collector remains unhealthy, support will collect diagnostics and investigate on your behalf.
Collect diagnostics yourself
If you want to collect a diagnostics bundle before contacting support:
- After making the underlying collectors visible in Fleet, select the unhealthy collector on the Agents page.
- From the actions menu , select Maintenance and diagnostics → Request diagnostics .zip.
- Download and unzip the diagnostics bundle. For more information, refer to Common problems with Fleet and Elastic Agent.
Elastic Managed integrations are a fully managed service, so Elastic handles diagnostics for you. Errors that are relevant to you are surfaced for each integration in the Integrations app. If you suspect a problem with the service or your deployment, contact Elastic Support — they'll collect diagnostics on your behalf and investigate.
On Elastic Stack 9.1 through 9.4, you can override the default and expose the underlying collectors in Fleet:
- In Kibana, find Fleet in the navigation menu or use the global search field.
- Go to the Settings tab.
- In the Advanced Settings section, enable Show agentless resources.
- In Kibana, find Fleet in the navigation menu or use the global search field.
- Add the query parameter
?showAgentless=trueto the end of the page's URL.
For Elastic Managed integrations to connect to your cluster, the Fleet Server host value must be the default. Otherwise, the collector shows as Offline on the Fleet page, and logs include the error [elastic_agent][error] Cannot checkin in with fleet-server, retrying.
To troubleshoot:
- Find Fleet in the navigation menu or use the global search field. Go to the Settings tab.
- Under Fleet server hosts, click the Edit icon
for the host named
Default. This opens the Edit Fleet Server flyout. The host namedDefaultmust have the Make this Fleet Server the default one setting enabled. If not, enable it, then delete and re-create your integration.
If the setting was already enabled but problems persist, the default Fleet Server URL might have been changed. Contact Elastic Support to recover the original URL.
On Elastic Cloud Hosted deployments with Elastic Stack versions before 9.1.6, the connection between Elastic Managed integrations and Fleet Server can break if the default Fleet Server host URL is modified or if a different host URL is set as the default.
This issue is resolved in Elastic Stack 9.1.6 and later. In those versions, Elastic Managed integration policies are assigned to a default managed Fleet Server host that can't be modified.
On Elastic Stack versions before 9.2, Elastic Managed integrations can't be upgraded to later versions of the integration. To get a later version, upgrade to Elastic Stack 9.2 or later, or delete and re-install the integration.
Deleting an Elastic Managed integration removes all associated resources and stops data ingestion.
- In Kibana, find Integrations in the navigation menu or use the global search field, then search for your integration.
- Go to the integration's Integration policies tab.
- Find the integration policy to delete. Click the actions icon , then select Delete integration.
- Confirm by clicking Delete integration again.