# Triagic + Elasticsearch: ticket investigations over your logs, errors and metrics, read-only

> Elasticsearch in Triagic: Search application logs and documents, inspect mappings and shards. Read-only, with a credential you configure.

Source: https://triagic.com/integrations/elasticsearch

## What you can ask

- Check Elasticsearch for errors from the checkout service in the last hour and group them by message
- In Elasticsearch, did latency for the import worker change after the 16:02 deploy?
- Find every Elasticsearch event that mentions request id 7f3a-…-c2 and put them in order
- Is the alert in Elasticsearch for the export queue still firing, and since when?
- What did Elasticsearch record for the pod that restarted at 11:31?

## What the agent can do

- `list_indices`
- `get_mappings`
- `search`
- `get_shards`

## Connect in three steps

1. **Mint a read-only credential in Elasticsearch.** Create a dedicated user or token that can only read. The pinned version ships only search, mappings, indices and shards tools, and all four are exposed.
2. **Add it in the Triagic portal.** Integrations, then Add shared data source, then Elasticsearch. Fill in: Cluster URL (required)
3. **Let a desktop pick it up.** Saving validates the shape of what you typed. The first desktop app to sync starts Elasticsearch locally and reports running or degraded with the error text.

Setup reference: https://triagic.com/docs/integrations/observability#elasticsearch

## Read-only, by construction

The pinned version ships only search, mappings, indices and shards tools, and all four are exposed.

## FAQ

**Can Triagic change anything in Elasticsearch?**
No. The pinned version ships only search, mappings, indices and shards tools, and all four are exposed. Give it a read-only credential as well, so the guarantee does not rest on one layer.

**What do I need to connect Elasticsearch?**
Cluster URL. The desktop app on a member's machine starts the connection; the portal never holds a live process.

**Does Elasticsearch cost extra?**
No. Every connector is included in the seat price. Start a 14-day trial without a card.

## Related integrations

- [Sentry](https://triagic.com/integrations/sentry)
- [Prometheus](https://triagic.com/integrations/prometheus)
- [OpenSearch](https://triagic.com/integrations/opensearch)
- [Datadog](https://triagic.com/integrations/datadog)