Elasticsearch

1. Sign in to Elastic Cloud
2. Open your deployment: Click on the deployment you want to open
3. Copy the Elasticsearch Endpoint: On the deployment page, copy the Elasticsearch endpoint URL. You’ll need this later.
4. Create API Key:
   • Go to Security > API keys
   • Click Create API key
   
5. Configure API Key:
   • Name: Enter nofireai
   • Control security privileges: Select read to ensure the key has read-only access
   • Index privileges: Click read-only access
   • Click Create API key
   
6. Save API Key:
   The API key value will only be displayed once and cannot be retrieved later. Make sure to copy and securely store it before closing this window.
   Copy the API key value (the encoded string, not the ID).

1. Access Kibana: Navigate to your Kibana URL (typically https://your-elasticsearch-host:5601)
2. Log in: Use your Elasticsearch admin credentials
3. Navigate to Stack Management: Open the hamburger menu (☰) and go to Management > Stack Management
4. Create API Key: Follow steps 6-8 from Option A above

1. Select Elasticsearch: From the list of available connections Then, click Next at the top right corner.
2. Enter Connection Details:
   • Connection name: Enter a descriptive name (e.g., “production-elasticsearch”)
   • URL: The endpoint to your Elasticsearch instance (including the port number)
     • Example: https://my-elasticsearch-project-a09d34.es.us-central1.gcp.elastic.cloud:443
   • Token: The API Key that was generated in the previous step

   

3. Test and Save: Click Test Connection to verify the credentials, then Save to create the connection. Once the connection to your log source is established, NOFire AI will query and analyze logs on-demand as part of its automated root cause analysis. Logs are used to enrich the investigation process.

​

Connection Timeout

• Verify that your Elasticsearch endpoint is accessible from NOFire AI’s network
• For Elastic Cloud, check your deployment’s traffic filters
• Ensure firewall rules allow traffic on port 9200 or 9243 (Elastic Cloud)

​

Authentication Failed

• Ensure the API key or user hasn’t been revoked or expired

​

Forbidden or Authorization Errors

• Verify the API key or user has the correct index privileges
• Check that the role includes read and view_index_metadata privileges
• Ensure the index pattern in the role configuration matches the indices you’re querying

​

SSL Certificate Errors

• Ensure your SSL certificate is valid and not self-signed (or add it to trusted certificates)
• Verify the hostname in the URL matches the certificate