An index connector indexes a document into Elasticsearch.

You can create index connectors in Kibana or by using the create connector API. Alternatively, you can use the preconfigured alert history Elasticsearch index connector. If you are running Kibana on-prem, you can also create more preconfigured index connectors.

Create connectors in Kibanaedit

You can create connectors in Stack Management > Connectors or as needed when you’re creating a rule. For example:

Connector configurationedit

Index connectors must have a name and an Elasticsearch index. You can optionally set the refresh policy and the time field, which contains the details about when each alert condition was detected.

Create preconfigured connectorsedit

If you are running Kibana on-prem, you can define connectors by adding xpack.actions.preconfigured settings to your kibana.yml file. For example:

xpack.actions.preconfigured:
  my-index:
    name: preconfigured-index-connector-type
    actionTypeId: .index
    config:
      index: .kibana
      refresh: true 
      executionTimeField: my-field

For more information, go to Preconfigured connectors.

Preconfigured alert history Elasticsearch index connectoredit

Kibana offers a preconfigured index connector to facilitate indexing active alert data into Elasticsearch.

To use this connector, set xpack.actions.preconfiguredAlertHistoryEsIndex to true.

When you subsequently create rules, you can use the Alert history Elasticsearch index (preconfigured) connector.

Documents are indexed using a preconfigured schema that captures the action variables available for the rule. By default, these documents are indexed into the kibana-alert-history-default index, but you can specify a different index. Index names must start with kibana-alert-history- to take advantage of the preconfigured alert history index template.

Test connectorsedit

You can test connectors with the run connector API or as you’re creating or editing the connector in Kibana. For example:

Index connector actions contain a document in JSON format. For example, if you have an index with the following properties:

PUT test
{
    "settings" : {
        "number_of_shards" : 1
    },
    "mappings" : {
        "properties" : {
            "rule_id" : { "type" : "text" },
            "rule_name" : { "type" : "text" },
            "alert_id" : { "type" : "text" },
            "context_message": { "type" : "text" }
        }
    }
}

Your test document could contain the following properties and variables:

{
    "rule_id": "{{rule.id}}",
    "rule_name": "{{rule.name}}",
    "alert_id": "{{alert.id}}",
    "context_message": "{{context.message}}"
}