Elastic Docs

https://www.elastic.co/docs
Admin
Welcome to the technical documentation for Elastic Stack 9.0.0 and later, and Elastic Cloud...
Tokens:3,516,427
Snippets:27,787
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install eck-stack with example values files

Source: https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/managing-deployments-using-helm-chart

Installs an eck-managed Elasticsearch and Kibana using example values files from the project repository. Uses the Elasticsearch node roles example with hot, warm, and cold data tiers, and the Kibana example customizing the http service.

```bash
# Install an eck-managed Elasticsearch and Kibana using the Elasticsearch node roles example with hot, warm, and cold data tiers, and the Kibana example customizing the http service.
helm install es-quickstart elastic/eck-stack -n elastic-stack --create-namespace \
    --values https://raw.githubusercontent.com/elastic/cloud-on-k8s/3.5/deploy/eck-stack/examples/elasticsearch/hot-warm-cold.yaml \
    --values https://raw.githubusercontent.com/elastic/cloud-on-k8s/3.5/deploy/eck-stack/examples/kibana/http-configuration.yaml
```

--------------------------------

### Filebeat setup output

Source: https://www.elastic.co/docs/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-beats-to-elasticsearch-service-with-logstash-as-proxy

Example output from the Filebeat setup command, showing successful index setup, dashboard loading, and ML job configuration.

```text
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
Setting up ML using setup --machine-learning is going to be removed in 8.0.0. Use the ML app instead.
See more: /explore-analyze/machine-learning.md
Loaded machine learning job configurations
Loaded Ingest pipelines

```

--------------------------------

### Install Go client

Source: https://www.elastic.co/docs/solutions/vector-database/vector-full-text-search

Install the Elasticsearch Go client using go get.

```bash
go get github.com/elastic/go-elasticsearch/v9
```

--------------------------------

### Example response for GET extension with include_deployments

Source: https://www.elastic.co/docs/deploy-manage/plugins-and-custom-configuration-files/elastic-cloud/manage-plugins-extensions-through-api

Example JSON response returned by the previous GET call when include_deployments=true, showing the extension details and the deployments using it.

```json
{
    "name": "custom-plugin",
    "url": "repo://2286113333",
    "extension_type": "plugin",
    "deployments": [
        "f91f3a9360a74e9d8c068cd2698c92ea"
    ],
    "version": "8.4.3",
    "id": "2286113333"
}
```

--------------------------------

### Mock Kibana Core setup and start contracts with coreMock

Source: https://www.elastic.co/docs/extend/kibana/tutorials/testing-kibana-plugin

Use coreMock from '@kbn/core/public/mocks' to get the whole core setup or start contracts. The example shows creating a setup mock and overriding the uiSettings.get method implementation.

```typescript
import { coreMock } from '@kbn/core/public/mocks';

const coreSetup = coreMock.createSetup();
coreSetup.uiSettings.get.mockImplementation((key: string) => {
  …
});
…
const plugin = new MyPlugin(coreSetup, ...);
		
```

--------------------------------

### Show setup command help

Source: https://www.elastic.co/docs/extend/beats/import-dashboards

Displays help for the `setup` command, listing dependencies and flags. Useful for understanding what the setup command does and available options.

```bash
./metricbeat help setup

This command does initial setup of the environment:

 * Index mapping template in Elasticsearch to ensure fields are mapped.
 * Kibana dashboards (where available).
 * ML jobs (where available).
 * Ingest pipelines (where available).
 * ILM policy (for Elasticsearch 6.5 and newer).

Usage:
  metricbeat setup [flags]

Flags:
      --dashboards         Setup dashboards
  -h, --help               help for setup
      --index-management   Setup all components related to Elasticsearch index management, including template, ilm policy and rollover alias
      --pipelines          Setup Ingest pipelines
		
```

--------------------------------

### Install eck-stack with default values

Source: https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/managing-deployments-using-helm-chart

Installs an eck-managed Elasticsearch and Kibana using the default values, which deploys the quickstart examples. Creates the namespace 'elastic-stack' if it does not exist.

```bash
# Install an eck-managed Elasticsearch and Kibana using the default values, which deploys the quickstart examples.
helm install es-kb-quickstart elastic/eck-stack -n elastic-stack --create-namespace
```

--------------------------------

### Start live-preview server

Source: https://www.elastic.co/docs/extend/kibana/contributing/codebase/documentation

Start a live-preview server at http://localhost:3000.

```bash
docs-builder serve
		
```

--------------------------------

### Start Filebeat with filebeat.yml

Source: https://www.elastic.co/docs/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-beats-to-elasticsearch-service-with-logstash-as-proxy

Run this command from the Filebeat installation path to start Filebeat with its configuration file. This is part of a manual setup where Logstash outputs the data to Elastic Cloud.

```bash
./filebeat -c filebeat.yml

```

--------------------------------

### setup.template.name and setup.template.pattern example

Source: https://www.elastic.co/docs/reference/beats/filebeat/configuration-template

Shows how to set the template name and pattern. The default name and pattern are 'filebeat', with the Filebeat version appended.

```yaml
setup.template.name: "filebeat"
setup.template.pattern: "filebeat"
		
```

--------------------------------

### Start Metricbeat with metricbeat.yml

Source: https://www.elastic.co/docs/manage-data/ingest/ingesting-data-from-applications/ingest-data-from-beats-to-elasticsearch-service-with-logstash-as-proxy

Run this command from the Metricbeat installation path to start Metricbeat with its configuration file. This is part of a manual setup where Logstash outputs the data to Elastic Cloud.

```bash
./metricbeat -c metricbeat.yml

```

--------------------------------

### Create example.ini with deployment details

Source: https://www.elastic.co/docs/manage-data/ingest/ingesting-data-from-applications/ingest-data-with-python-on-elasticsearch-service

Configuration file for basic authentication. Replace DEPLOYMENT_NAME:CLOUD_ID_DETAILS, elastic, and LONGPASSWORD with your actual deployment credentials.

```ini
[ELASTIC]
cloud_id = DEPLOYMENT_NAME:CLOUD_ID_DETAILS
user = elastic
password = LONGPASSWORD
		
```

--------------------------------

### Install ICU analysis plugin with init container

Source: https://www.elastic.co/docs/deploy-manage/plugins-and-custom-configuration-files/cloud-on-k8s/init-containers-for-plugin-downloads

Use an init container to run `elasticsearch-plugin install` before the main Elasticsearch container starts. Each new node repeats the download, so pods need network access to reach the plugin source. The example installs the ICU analysis plugin.

```yaml
spec:
  nodeSets:
  - name: default
    count: 3
    podTemplate:
      spec:
        initContainers:
        - name: install-plugins
          command:
          - sh
          - -c
          - |
            bin/elasticsearch-plugin remove --purge analysis-icu
            bin/elasticsearch-plugin install --batch analysis-icu
		
```

--------------------------------

### Example configuration for system module

Source: https://www.elastic.co/docs/reference/beats/auditbeat/auditbeat-module-system

Full example configuration showing the system module with package, host, login, process, socket, and user datasets. Sets state.period to 12h, enables user.detect_password_changes, and specifies login file patterns.

```yaml
auditbeat.modules:
- module: system
  datasets:
    - package

  period: 2m

- module: system
  datasets:
    - host
    - login
    - process
    - socket
    - user

  # How often datasets send state updates with the
  # current state of the system (e.g. all currently
  # running processes, all open sockets).
  state.period: 12h

  # Enabled by default. Auditbeat will read password fields in
  # /etc/passwd and /etc/shadow and store a hash locally to
  # detect any changes.
  user.detect_password_changes: true

  # File patterns of the login record files.
  login.wtmp_file_pattern: /var/log/wtmp*
  login.btmp_file_pattern: /var/log/btmp*
		
```

--------------------------------

### Output of kubectl get service quickstart-es-http

Source: https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/elasticsearch-deployment-quickstart

Example output from the previous command, showing the service details including the ClusterIP and port 9200/TCP.

```text
NAME                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
quickstart-es-http   ClusterIP   10.15.251.145   <none>        9200/TCP   34m
```

--------------------------------

### Register the custom search strategy (plugin.ts server)

Source: https://www.elastic.co/docs/extend/kibana/tutorials/kibana-data-search-services

Registers the custom strategy with the data plugin's search service during the setup lifecycle. Uses the start services to get the data plugin start contract and calls registerSearchStrategy with the strategy name 'myCustomStrategy'.

```typescript
// ./myPlugin/server/plugin.ts
import type { CoreSetup, CoreStart, Plugin } from '@kbn/core/server';

import { mySearchStrategyProvider } from './my_strategy';

/**
 * Your plugin will receive the `data` plugin contact in both the setup and start lifecycle hooks.
 */
export interface MyPluginSetupDeps {
  data: PluginSetup;
}

export interface MyPluginStartDeps {
  data: PluginStart;
}

/**
 * In your custom server side plugin, register the strategy from the setup contract
 */
export class MyPlugin implements Plugin {
  public setup(core: CoreSetup<MyPluginStartDeps>, deps: MyPluginSetupDeps) {
    core.getStartServices().then(([_, depsStart]) => {
      const myStrategy = mySearchStrategyProvider(depsStart.data);
      deps.data.search.registerSearchStrategy('myCustomStrategy', myStrategy);
    });
  }
}
		
```

--------------------------------

### Get Agent status with kubectl get agent

Source: https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/quickstart-standalone

Monitors the status of Elastic Agent, showing health, available, expected, version, and age. The example output shows the `quickstart` Agent with health `green` and 3 replicas at version `9.5.5` after 15 seconds.

```bash
kubectl get agent
```

```output
NAME            HEALTH   AVAILABLE   EXPECTED   VERSION   AGE
quickstart      green    3           3          9.5.5    15s
```

--------------------------------

### Set up Filebeat assets and start Filebeat

Source: https://www.elastic.co/docs/manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat

Run these commands from the Filebeat installation directory to load predefined assets and start Filebeat. The second command starts Filebeat in the foreground. You may need to change ownership of filebeat.yml or use --strict.perms=false if you encounter permission issues.

```bash
./filebeat setup -e
./filebeat -e
		
```

--------------------------------

### Start a local port-forward

Source: https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/elasticsearch-deployment-quickstart

This command starts a port-forward from localhost:9200 to the quickstart-es-http service. It is intended for local testing only; for production, consider using a LoadBalancer service.

```bash
kubectl port-forward service/quickstart-es-http 9200
```

--------------------------------

### Test optional plugin dependencies with mocks

Source: https://www.elastic.co/docs/extend/kibana/testing/unit-tests

Test plugin behavior when optional dependencies are absent. The example verifies that setup and start do not throw when usageCollection is disabled, using coreMock and dataPluginMock.

```typescript
// src/platform/plugins/myplugin/public/plugin.test.ts
import { coreMock } from '@kbn/core/public/mocks';
import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
import { MyPlugin } from './plugin';

describe('Plugin', () => {
  it('initializes correctly if usageCollection is disabled', () => {
    const plugin = new MyPlugin(coreMock.createPluginInitializerContext());
    const coreSetup = coreMock.createSetup();
    const setupDeps = { data: dataPluginMock.createSetupContract() };

    expect(() => { plugin.setup(coreSetup, setupDeps); }).not.toThrow();
    expect(() => { plugin.start(coreMock.createStart(), { data: dataPluginMock.createStartContract() }); }).not.toThrow();
  });
});
```

--------------------------------

### Start Kibana with --run-examples flag

Source: https://www.elastic.co/docs/extend/kibana/getting-started/set-up-a-development-environment

Starts Kibana with developer examples enabled by adding the --run-examples flag.

```bash
pnpm start --run-examples
```

--------------------------------

### Create and customize a span with the span API

Source: https://www.elastic.co/docs/reference/apm/agents/java/method-api

Use ElasticApm.currentSpan() to get the current span, then start a child span, activate it, and customize it with setName and addLabel. The example shows exception capture and span ending in a finally block.

```java
import co.elastic.apm.api.ElasticApm;
import co.elastic.apm.api.Span;

Span parent = ElasticApm.currentSpan();
Span span = parent.startSpan();
try (Scope scope = span.activate()) {
    span.setName("SELECT FROM customer");
    span.addLabel("foo", "bar");
    // do your thing...
} catch (Exception e) {
    span.captureException(e);
    throw e;
} finally {
    span.end();
}
```

--------------------------------

### Quickstart: Elastic Agent Pods status and kubectl logs

Source: https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/quickstart-fleet

Shows the running Elastic Agent Pods from the quickstart. Use the kubectl logs command to tail logs for one of the Pods.

```text
NAME                                   READY   STATUS    RESTARTS   AGE
elastic-agent-quickstart-agent-t49fd   1/1     Running   0          54s
elastic-agent-quickstart-agent-xbcxr   1/1     Running   0          54s
elastic-agent-quickstart-agent-zqp55   1/1     Running   0          54s
		
```

```bash
kubectl logs -f elastic-agent-quickstart-agent-xbcxr
		
```

--------------------------------

### TestUtils example for HTTP route integration test

Source: https://www.elastic.co/docs/extend/kibana/testing/integration-tests

Jest-based integration test using TestUtils to start a real Kibana server and test the GET /myPlugin/formatter route. It verifies validation (400) and formatting (200) behavior.

```typescript
// src/platform/plugins/my_plugin/server/integration_tests/formatter.test.ts
import { createRoot, request } from '@kbn/core-test-helpers-kbn-server';

describe('myPlugin', () => {
  describe('GET /myPlugin/formatter', () => {
    let root: ReturnType<typeof createRoot>;

    beforeAll(async () => {
      root = createRoot();
      await root.preboot();
      await root.setup();
      await root.start();
    }, 30000);

    afterAll(async () => await root.shutdown());

    it('validates given text', async () => {
      const response = await request
        .get(root, '/myPlugin/formatter')
        .query({ text: 'input string'.repeat(100) })
        .expect(400);

      expect(response.body).toHaveProperty('message');
    });

    it('formats given text', async () => {
      const response = await request
        .get(root, '/myPlugin/formatter')
        .query({ text: 'input string' })
        .expect(200);

      expect(response.text).toBe('...');
    });
  });
});
		
```

--------------------------------

### Get allocator metadata example

Source: https://www.elastic.co/docs/deploy-manage/deploy/cloud-enterprise/migrate-ece-to-podman-hosts

Example response from the Get allocator metadata API showing allocator details and metadata tags.

```json
{
  "allocator_id": "192.168.44.17",
  "zone_id": "ece-zone-1",
  "host_ip": "192.168.44.17",
  "public_hostname": "192.168.44.17",
  "capacity": {
      "memory": {
          "total": 26000,
          "used": 0
      }
  },
  "settings": {},
  "instances": [],
  "metadata": [
      {
          "key": "containerengine",
          "value": "podman"
      }
  ]
}
```

--------------------------------

### Run setup command to import dashboards

Source: https://www.elastic.co/docs/extend/beats/import-dashboards

Use `./metricbeat setup` to import all dashboards and index patterns for a Beat, including dependencies like visualizations and searches. This loads index mapping template, Kibana dashboards, ingest pipelines, and ILM policy.

```bash
./metricbeat setup
		
```

--------------------------------

### Good: Use dataViewStartContract.get() instead of savedObjectsClient.get()

Source: https://www.elastic.co/docs/extend/kibana/contributing/codebase/saved-objects-and-migrations

Use the plugin's API to retrieve saved objects managed by other plugins. This example shows the recommended way to get a data view using the data view start contract.

```typescript
const dataView = dataViewStartContract.get(dataViewId);
		
```

--------------------------------

### Start primary cluster for remote clusters setup

Source: https://www.elastic.co/docs/extend/kibana/getting-started/running-elasticsearch

Starts the primary Elasticsearch cluster for cross-cluster search (CCS) and cross-cluster replication (CCR) setup.

```bash
pnpm es snapshot -E path.data=../data_prod1

```

--------------------------------

### Create global.setup.ts file structure

Source: https://www.elastic.co/docs/extend/kibana/testing/global-setup-hook

Shows the directory structure with global.setup.ts inside the testDir folder.

```text
test/scout/ui/
└── parallel_tests/
    ├── global.setup.ts
    └── some_suite.spec.ts
```

--------------------------------

### Example output from running the plugin

Source: https://www.elastic.co/docs/extend/logstash/input-new-plugin

This is the expected output from the example input plugin, showing the message, version, timestamp, and host.

```text
{
       "message" => "Hello World!",
      "@version" => "1",
    "@timestamp" => "2015-01-27T19:17:18.932Z",
          "host" => "cadenza"
}
```

--------------------------------

### mid helper example

Source: https://www.elastic.co/docs/explore-analyze/dashboards/create-url-drilldown

Extract a substring from a string by start position and number of characters to extract. Example extracts five characters starting from the third character.

```handlebars
{{mid event.value 3 5}}
```
Tokens:
Raw