elasticsearch-integration.mdx

title	tags	metaDescription	redirects
Elasticsearch monitoring integration	Integrations On-host integrations On-host integrations list	New Relic's Elasticsearch integration: what data it reports and how to configure it.	/docs/integrations/host-integrations/host-integrations-list/elasticsearch-monitoring-integration /docs/elasticsearch-monitoring-integration /docs/elasticsearchonhost-integration-new-relic-infrastructure /docs/infrastructure/host-integrations/host-integrations-list/elasticsearch-monitoring-integration

import windows from './images/windows.png';

import ecs from './images/ecs.png';

import kubernetes from './images/kubernetes-k8.png';

Our Elasticsearch integration collects and sends inventory and metrics from your Elasticsearch cluster to our platform, where you can see the health of your Elasticsearch environment. We collect metrics at the cluster, node, and index level so you can more easily find the source of any problems.

To install the Elasticsearch monitoring integration, run through the following steps:

1. Configure the integration.
2. Install and activate the integration.
3. Find and use data.
4. Optionally, see the advanced configuration settings.

Compatibility and requirements [#req]

Elasticsearch versions [#elasticsearch-versions]

Our integration is compatible with Elasticsearch 5.X through 7.X.

Supported operating systems [#supported-os]

• Windows
• Linux

For a comprehensive list of specific windows and linux versions, check the table of compatible operating systems.

System requirements [#system-reqs]

• A New Relic account. Don't have one? Sign up for free! No credit card required.
• If Elasticsearch is not running on Kubernetes or Amazon ECS, install the infrastructure agent on a host that's running Elasticsearch. Otherwise:
  • If running on Kubernetes, see these requirements.
  • If running on Amazon ECS, see these requirements.

Configure the integration [#config]

There are several ways to configure the integration, depending on how it was installed:

• If enabled via Kubernetes, see Monitor services running on Kubernetes.
• If enabled via Amazon ECS, see Monitor services running on ECS.
• If installed on-host, edit the config in the integration's YAML config file, elasticsearch-config.yml. An integration's YAML-format configuration is where you can place required login credentials and configure how data is collected. Which options you change depend on your setup and preference. The configuration file has common settings applicable to all integrations, such as interval, timeout, inventory_source. To read all about these common settings, refer to our configuration format document.

If you are still using our legacy configuration or definition files, check the [standard configuration format](/docs/create-integrations/infrastructure-integrations-sdk/specifications/host-integrations-standard-configuration-format/).

Install and activate the integration [#install]

To install the Elasticsearch integration, follow the instructions for your environment:

Linux installation [#linux]

1. Follow the instructions for installing an integration, and use nri-elasticsearch as filename.
2. Change directory to the integrations configuration folder by running:

cd /etc/newrelic-infra/integrations.d

3. Copy the sample configuration file by running:

sudo cp elasticsearch-config.yml.sample elasticsearch-config.yml

4. Edit the elasticsearch-config.yml configuration file with your favorite editor. Check out some great configuration file examples.
5. Restart the infrastructure agent. See how to restart the infrastructure agent in different Linux environments.
6. To enable automatic Elasticsearch error log parsing and forwarding, copy (or rename) the elasticsearch-log.yml.example file to elasticsearch-log.yml. No need to restart the agent.

Example:

sudo cp /etc/newrelic-infra/logging.d/elasticsearch-log.yml.example /etc/newrelic-infra/logging.d/elasticsearch-log.yml

Other environments [#other-env]

Windows installation} > 1. Download the `nri-elasticsearch` .MSI installer image from:

   [http://download.newrelic.com/infrastructure_agent/windows/integrations/nri-elasticsearch/nri-elasticsearch-amd64.msi](http://download.newrelic.com/infrastructure_agent/windows/integrations/nri-elasticsearch/nri-elasticsearch-amd64.msi)
2. To install from the Windows command prompt, run:

   ```
   msiexec.exe /qn /i <var>PATH\TO\</var>nri-elasticsearch-amd64.msi
   ```
3. In the integration's directory, `C:\Program Files\New Relic\newrelic-infra\integrations.d\`, create a copy of the sample configuration file by running:

   ```
   cp elasticsearch-config.yml.sample elasticsearch-config.yml
   ```
4. Edit the `elasticsearch-config.yml`file as described in [elasticsearch-config.yml sample files](#examples).
5. [Restart the infrastructure agent](/docs/infrastructure/new-relic-infrastructure/configuration/start-stop-restart-check-infrastructure-agent-status).

{' '} Amazon ECS installation } > See [Monitor service running on ECS](/docs/integrations/host-integrations/host-integrations-list/monitor-services-running-amazon-ecs).

Kubernetes installation} > See [Monitor service running on Kubernetes](/docs/monitor-service-running-kubernetes).

Additional notes:

• Advanced: Integrations are also available in tarball format to allow for install outside of a package manager.
• On-host integrations do not automatically update. For best results, regularly update the integration package and the infrastructure agent.

elasticsearch-config.yml sample files [#examples]

This is the basic configuration used to collect metrics and inventory from your localhost:

```yaml
integrations:
  - name: nri-elasticsearch
    env:
      HOSTNAME: localhost
      PORT: 9200
      USERNAME: elasticsearch_user
      PASSWORD: elasticsearch_password
      CONFIG_PATH: /etc/elasticsearch/elasticsearch.yml
    interval: 15s
    labels:
      environment: production
    inventory_source: config/elasticsearch
```

This configuration collects metrics every 15 seconds and inventory every 60 seconds:

```yaml
integrations:
  - name: nri-elasticsearch
    env:
      METRICS: true
      HOSTNAME: localhost
      PORT: 9200
      USERNAME: elasticsearch_user
      PASSWORD: elasticsearch_password
      REMOTE_MONITORING: true
    interval: 15s
    labels:
      environment: production

  - name: nri-elasticsearch
    env:
      INVENTORY: true
      HOSTNAME: localhost
      PORT: 9200
      USERNAME: elasticsearch_user
      PASSWORD: elasticsearch_password
      CONFIG_PATH: /etc/elasticsearch/elasticsearch.yml
    interval: 60s
    labels:
      environment: production
    inventory_source: config/elasticsearch
```

<Collapser id="envvar-replacement" title="Environment variables replacement"

In this configuration we are using the environment variable `ELASTIC_HOST` to populate the HOSTNAME setting of the integration:

```yaml
integrations:
  - name: nri-elasticsearch
    env:
      METRICS: "true"
      HOSTNAME: {{ELASTIC_HOST}}
      PORT: 9200
      USERNAME: elasticsearch_user
      PASSWORD: elasticsearch_password
    interval: 15s
    labels:
      env: production
      role: load_balancer
```

<Collapser id="multi-instance" title="Multi-instance monitoring"

In this configuration we are monitoring multiple Elasticsearch servers from the same integration. For the first instance (`HOSTNAME: 1st_elasticsearch_host`) we are collecting metrics and inventory while for the second instance (`HOSTNAME: 2nd_elasticsearch_host`) we will only collect metrics.

```yaml
integrations:
  - name: nri-elasticsearch
    env:
      METRICS: "true"
      HOSTNAME: 1st_elasticsearch_host
      PORT: 9200
      USERNAME: elasticsearch_user
      PASSWORD: elasticsearch_password
    interval: 15s
    labels:
      env: production
      role: load_balancer
  - name: nri-elasticsearch
    env:
      INVENTORY: "true"
      HOSTNAME: /1st_elasticsearch_host
      PORT: 9200
      USERNAME: elasticsearch_user
      PASSWORD: elasticsearch_password
    interval: 60s
    labels:
      env: production
      role: load_balancer
    inventory_source: config/elasticsearch

  - name: nri-elasticsearch
    env:
      METRICS: "true"
      HOSTNAME: 2nd_elasticsearch_host
      PORT: 9200
      USERNAME: elasticsearch_user
      PASSWORD: elasticsearch_password
    interval: 15s
    labels:
      env: production
      role: load_balancer
```

Find and use data [#find-and-use]

Data from this service is reported to an integration dashboard.

Elasticsearch data is attached to the following event types:

• ElasticsearchClusterSample
• ElasticsearchNodeSample
• ElasticsearchCommonSample
• ElasticsearchIndexSample

You can query this data for troubleshooting purposes or to create custom charts and dashboards.

For more on how to find and use your data, see:

• Elasticsearch's advanced configuration
• Understand integration data