Upload custom plugins and bundlesedit

There are several cases where you might need your own files to be made available to your Elasticsearch cluster’s nodes:

  • Your own custom plugins, or third-party plugins that are not amongst the officially available plugins.
  • Custom dictionaries, such as synonyms, stop words, compound words, etc.
  • Cluster configuration files, such as an Identity Provider metadata file used when you secure your clusters with SAML.

To facilitate this, we make it possible to upload a ZIP file that contains the files you want to make available. Uploaded files are stored using Amazon’s highly-available S3 service. This is necessary so we do not have to rely on the availability of third-party services, such as the official plugin repository, when provisioning nodes.

Custom plugins and bundles are collectively referred to as extensions.

Before you beginedit

The selected plugins/bundles are downloaded and provided when a node starts. Changing a plugin does not change it for nodes already running it. See Updating Plugins and Bundles.

With great power comes great responsibility: Your plugins can extend your cluster with new functionality, but also make it break. Be careful. We obviously cannot guarantee that your custom code works.

You cannot edit or delete a custom extension after it has been used in a deployment. To remove it from your deployment, you can disable the extension and update your deployment configuration.

Uploaded files cannot be bigger than 20 MB for most subscription levels, for Platinum the limit is 3 GB.

It is important that plugins and dictionaries that you reference in mappings and configurations are available at all times. For example, if you try to upgrade Elasticsearch and de-select a dictionary that is referenced in your mapping, the new nodes will be unable to recover the cluster state and function. This is true even if the dictionary is referenced by an empty index you do not actually use.

Prepare your files for uploadedit

Files you upload need to be in ZIP file format. You need to choose whether your uploaded file should be treated as a plugin or as a bundle. Bundles are not installed as plugins. If you need to upload both a custom plugin and custom dictionaries, upload them separately.

To prepare your files, create one of the following:


A plugin is a ZIP file that is installable as a plugin using Elasticsearch’s plugin tool. When configuring the node of your cluster, that is exactly what we do. We invoke the install-tool with the URL of the uploaded ZIP file. This makes it easy for you to test that your uploaded ZIP file works locally: just see if you can run ./bin/elasticsearch-plugin install file:///path/to/plugin.zip yourself.

Elasticsearch’s plugin tool assumes that the uploaded ZIP file contains binaries. If it finds any source code, it will fail with an error message, causing provisioning to fail. Make sure you upload binaries, and not source code.


The entire content of a bundle is made available to the node by extracting to the Elasticsearch container’s /app/config directory. This is useful to make custom dictionaries available. Dictionaries should be placed in a /dictionaries folder in the root path of your ZIP file.

Here are some examples of bundles:


$ tree .
└── scripts
    └── test.js

The script test.js can be referred in queries as "script": "test".

Dictionary of synonyms

$ tree .
└── dictionaries
    └── synonyms.txt

The dictionary synonyms.txt can be used as synonyms.txt or using the full path /app/config/dictionaries/synonyms.txt in the synonyms_path of the synonym-filter.

To learn more about analyzing with synonyms, see Synonym token filter and Formatting Synonyms.

GeoIP database bundle

$ tree .
└── ingest-geoip
    └── MyGeoLite2-City.mmdb

Note that the extension must be -(City|Country|ASN).mmdb, and it must be a different name than the original file name GeoLite2-City.mmdb which already exists in Elasticsearch Service. To use this bundle, you can refer it in the GeoIP ingest pipeline as MyGeoLite2-City.mmdb under database_file.

Add your extensionedit

You must upload your files before you can apply them to your cluster configuration:

  1. Log in to the Elasticsearch Service Console.
  2. Select your deployment on the home page in the Elasticsearch Service card or go to the deployments page.
  3. Under the Features tab, open the Extensions page.
  4. Click Create extension.
  5. Complete the extension fields, including the Elasticsearch version.

    • Plugins must use full version notation down to the patch level, such as 7.10.1. You cannot use wildcards. This version notation should match the version in your plugin’s plugin-descriptor.properties file and the target deployment version.
    • Bundles should specify major or minor versions with wildcards, such as 7.* or *. Wildcards are recommended to ensure the bundle is compatible across all versions of these releases.
  6. Select the extension Type.
  7. Under Plugin file, choose the file to upload.
  8. Click Create extension.

After creating your extension, you can enable them for existing Elasticsearch deployments or enable them when creating new deployments.

Update your deployment configurationedit

After uploading your files, you can select to enable them when creating a new Elasticsearch deployment. For existing deployments, you must update your deployment configuration to use the new files:

  1. Log in to the Elasticsearch Service Console.
  2. Select your deployment on the home page in the Elasticsearch Service card or go to the deployments page.

    Narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.

  3. From your deployment menu, click Edit.
  4. Click Settings and Plugins.
  5. From the Elasticsearch plugins and settings list, select the custom extension.
  6. Click Save.

The selected plugins or bundles are downloaded and provisioned when each node in your Elasticsearch cluster starts.

Update your extensionedit

While you can update the ZIP file for any plugin or bundle, these are downloaded and made available only when a node is started.

You should be careful when updating an extension. If you update an existing extension with a new file, and if the file is broken for some reason, all the nodes could be in trouble, as a restart or move node could make even HA clusters non-available.

If the extension is not in use by any deployments, then you are free to update the files or extension details as much as you like. However, if the extension is in use, and if you need to update it with a new file, it is recommended to create a new extension rather than updating the existing one that is in use.

By following this method, only the one node would be down even if the extension file is faulty. This would ensure that HA clusters remain available.

This method also supports having a test/staging deployment to test out the extension changes before applying them on a production deployment.

You may delete the old extension after updating the deployment successfully.

To update an extension with a new file version,

  1. Prepare a new plugin or bundle.
  2. On the Extensions page, create a new extension.
  3. Make your new files available by uploading them.
  4. Select your deployment on the home page in the Elasticsearch Service card or go to the deployments page.

    Narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.

  5. From your deployment menu, click Edit.
  6. Click Settings and Plugins.
  7. From the Elasticsearch plugins and settings list, select the new extension and de-select the old one.
  8. Click Save.

How to use the extensions APIedit

If you don’t already have one, create an API key

There are ways that you can use the extensions API to upload a file.

Method 1: Use HTTP POST to create metadata and then upload the file using HTTP PUTedit

Step 1: Create metadata

curl -XPOST \
-H "Authorization: ApiKey $EC_API_KEY" \
-H 'content-type:application/json' \
https://api.elastic-cloud.com/api/v1/deployments/extensions \
  "name" : "synonyms-v1",
  "description" : "The best synonyms ever",
  "extension_type" : "bundle",
  "version" : "7.*"

Step 2: Upload the file

curl -XPUT \
-H "Authorization: ApiKey $EC_API_KEY" \
"https://api.elastic-cloud.com/api/v1/deployments/extensions/$extension_id" \
-T /tmp/synonyms.zip

If you are using a client that does not have native application/zip handling like curl, be sure to use the equivalent of the following with content-type: multipart/form-data:

curl -XPUT \
-H 'Expect:' \
-H 'content-type: multipart/form-data' \
-H "Authorization: ApiKey $EC_API_KEY" \
"https://api.elastic-cloud.com/api/v1/deployments/extensions/$extension_id" -F "file=@/tmp/synonyms.zip"

For example, using the Python requests module, the PUT request would be as follows:

import requests
files = {'file': open('/tmp/synonyms.zip','rb')}
r = requests.put('https://api.elastic-cloud.com/api/v1/deployments/extensions/{}'.format(extension_id), files=files, headers= {'Authorization': 'ApiKey {}'.format(EC_API_KEY)})

Method 2: Single step. Use a download_url so that the API server downloads the object at the specified URLedit

curl -XPOST \
-H "Authorization: ApiKey $EC_API_KEY" \
-H 'content-type:application/json' \
https://api.elastic-cloud.com/api/v1/deployments/extensions \
  "name" : "anylysis_icu",
  "description" : "Helpful description",
  "extension_type" : "plugin",
  "version" : "7.13.2",
  "download_url": "https://artifacts.elastic.co/downloads/elasticsearch-plugins/analysis-icu/analysis-icu-7.13.2.zip"

Please refer to the Extensions API reference for the complete set of HTTP methods and payloads.