Skip to content

Integrating SailPoint with Elasticsearch

Elasticsearch is a distributed search and analytics engine. Identity and access for a cluster are managed through Elasticsearch Security (X-Pack): native users, roles, role mappings, and API keys, exposed as REST APIs under /_security/... on the Elasticsearch HTTP endpoint. This document provides instructions to configure a new direct connection to an Elasticsearch source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Elasticsearch connector supports the following:

Account Management

  • Aggregate Users

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  • Elasticsearch Base URL: Cluster endpoint from Elastic Cloud deployment page or self-managed install.

  • The Elasticsearch API key to access the data from your cluster. To obtain the API key, complete the following steps:

    1. Log in to Elastic Cloud and open your deployment.
    2. Go to Stack Management > Security > API keys.
    3. Copy the encoded API key value.

    Important

    Do not use Elastic Cloud organization API keys (api.elastic-cloud.com) for /_security/user unless they are explicitly scoped to the cluster.

  • For more information about authentication, refer to the Elasticsearch API authentication documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

  • To create an API key, the user must have the superuser role.
  • For non-admin users, to access the deployment directly, paste the Elasticsearch endpoint and then sign in with your username and password.