Notes and runbooks for running the Elastic Stack (Elasticsearch, Kibana, Logstash, Beats), both self-managed and on Elastic Cloud Hosted (ECH).
| Section | What's in it |
|---|---|
| Install | RPM install and a single-node Docker Compose stack |
| Ingest | Index templates, data streams, ingest pipelines, ECS, mapping validation |
| Search | Querying the REST API, _cat APIs, KQL, Query DSL, aggregations, ES|QL |
| Operations | Cluster health and metrics, disk space, ILM, upgrade notifications |
| Export | Dumping an index to local NDJSON |
| Kibana | Saved objects export, scripted-field audits, dashboards |
| Elastic Cloud | Managing ECH deployments with Terraform |
Conventions used in these pages¶
- Placeholders look like
[ placeholder ]— replace the whole thing, brackets included. - Shell examples read connection details from environment variables so nothing secret ends up in shell history:
bash
export ES_URL="https://[ elasticsearch_endpoint ]"
export KIBANA_URL="https://[ kibana_endpoint ]"
export ES_API_KEY="[ base64_api_key ]"
- Requests written as
GET _cat/indicesare Kibana Dev Tools console syntax. The curl equivalent iscurl -H "Authorization: ApiKey $ES_API_KEY" "$ES_URL/_cat/indices".