FerentinFerentin
Elasticsearch logo

Elasticsearch

Beta

Search, ES|QL, and index discovery over your Elasticsearch data via Elastic Agent Builder.

  • Elasticsearch
  • Elastic
  • Search
Configure Elasticsearch
Authentication
API key
Hosting
Vendor-hosted endpoint

How it works

Every agent request passes through Ferentin policy before it reaches Elasticsearch.

Ferentin connects to the Agent Builder MCP endpoint on your own Kibana deployment using an Elasticsearch API key sent with the ApiKey scheme. Because the endpoint is deployment-scoped, the server URL is supplied at install time. Elasticsearch role and index privileges on the key remain the authorization boundary.

  1. AI agentAsks for something
  2. Ferentin policies
    • API key scoped privileges
    • Index level authorization
    • Deployment scoped endpoint
  3. Elasticsearch MCP serverAuthorized connection
  4. Governed resultMasked, logged, returned

What you can do with Elasticsearch

  • Index search
  • Esql generation
  • Index discovery
  • Custom agent tools

Before you connect

  • The URL shipped with this card is an EXAMPLE host and will not resolve — installing without overriding the endpoint fails to connect.
  • The header scheme is 'ApiKey', NOT 'Bearer'. The credential value must include the literal 'ApiKey ' prefix; Ferentin sends the Authorization header verbatim.
  • Missing feature_agentBuilder.read or feature_actions.read produces HTTP 403 rather than a clear MCP error.
  • For a non-default Kibana space the path is {KIBANA_URL}/s/{space}/api/agent_builder/mcp.
2 more technical notes
  • Elasticsearch role and index privileges attached to the API key are the authorization boundary — scope the key to the indices the agent should reach.
  • The standalone mcp-server-elasticsearch project is deprecated and receives only critical security fixes; this Agent Builder endpoint supersedes it.

About Elasticsearch

Elasticsearch is a distributed search and analytics engine, and the foundation of the Elastic Stack for search, observability, and security workloads. Agent Builder is Elastic's framework for exposing indexed data to AI agents as governed tools.

WebsiteDeveloper docs

Frequently asked about Elasticsearch

What can AI agents do with Elasticsearch through Ferentin?
Through Ferentin, agents can use Elasticsearch for index search, esql generation, index discovery and custom agent tools. Every call is checked against your Ferentin policies first.
How is Elasticsearch access secured?
Requests through the Elasticsearch integration are covered by API key scoped privileges, index level authorization and deployment scoped endpoint. These controls are applied by Ferentin, not by Elasticsearch, so they hold across every connected agent.
How do I connect Elasticsearch to Ferentin?
Open the Ferentin admin console, add Elasticsearch as a new connection and authenticate with API key. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
Is the Elasticsearch integration generally available?
The Elasticsearch integration is currently beta on Ferentin.

Related integrations

3
Datadog logo
Beta

Datadog

Observability platform for logs, metrics, traces, monitors, incidents, security signals, and synthetic tests.

MCP ServersEnterprise-managed
View
Sentry logo
GA

Sentry

Error tracking and performance monitoring with AI-powered root cause analysis, issue search, replays, profiles, and event analytics.

MCP Servers
View
Databricks logo
Beta

Databricks

Query the Databricks lakehouse — SQL warehouses, Unity Catalog functions, Genie spaces, and vector search.

MCP Servers
View