# Integrating SailPoint with Elasticsearch

Elasticsearch is a distributed search and analytics engine. Identity and access for a cluster are managed through Elasticsearch Security (X-Pack): native users, roles, role mappings, and API keys, exposed as REST APIs under `/_security/...` on the Elasticsearch HTTP endpoint. This document provides instructions to configure a new direct connection to an Elasticsearch source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Elasticsearch connector supports the following:

### Account Management

- Aggregate Users

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- **Elasticsearch Base URL**: Cluster endpoint from Elastic Cloud deployment page or self-managed install.
- The **Elasticsearch API key** to access the data from your cluster. To obtain the API key, complete the following steps:

  1. Log in to [Elastic Cloud](<https://cloud.elastic.co/>) and open your deployment.
  2. Go to **Stack Management \> Security \> API keys**.
  3. Copy the **encoded** API key value.

  > **Important**
  >
  > Do not use Elastic Cloud organization API keys (`api.elastic-cloud.com`) for `/_security/user` unless they are explicitly scoped to the cluster.
- For more information about authentication, refer to the [Elasticsearch API authentication documentation](<https://www.elastic.co/docs/api/doc/elasticsearch/authentication>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

- To create an API key, the user must have the `superuser` role.
- For non-admin users, to access the deployment directly, paste the Elasticsearch endpoint and then sign in with your username and password.