# Elasticsearch

Search and analytics engine

- Category: Databases
- Runs in: the Phloem cloud

Lets you and Hamming search an Elasticsearch cluster, with each index's fields listed in Trace.

## What Phloem reads
- Every index, with its mapped fields, document count and size, listed in Trace
- Indices starting with `.` are left out

Phloem only searches. It never writes to the cluster.

## What you need
- A self-managed cluster's host and port (default 9200), reachable from Phloem's cloud, or an Elastic Cloud deployment's Cloud ID and an API key
- A username and password, or an API key, that can read the indices

## Connect
1. In the console, open **Connectors**, choose **Add connector**, then **Elasticsearch**.
2. Enter a **Display Name**.
3. Under **Authentication Method**, choose:
   - **Username & Password** — **Host**, **Port**, **Username** and **Password**
   - **API Key** — **Host**, **Port** and **API Key**
   - **Elastic Cloud** — **Cloud ID** and **API Key**
4. Leave **Verify SSL Certificates** on unless the cluster uses a self-signed certificate.
5. Choose **Test Connection** (it shows the cluster name and health), then **Create Connection**.

## What Hamming can do
- Search with JSON that you or Hamming write: `{"index": "logs", "query": {"match_all": {}}, "size": 100}`. `query` is Query DSL; `sort` is optional.

## Notes
- A search returns 100 hits unless it sets `size`.
- A search returns matching documents only, not aggregations.
- With **Host**, Phloem connects over plain HTTP. For a cluster that accepts only HTTPS, use **Elastic Cloud**.

## Connection fields

| Field | Type | Required | Notes |
|---|---|---|---|
| Host | Text | No |  |
| Port | Number | No |  |
| Username | Text | No |  |
| Password | Secret | No |  |
| Cloud ID | Text | No | Elastic Cloud deployment ID |
| API Key | Secret | No | API key for authentication |
| Verify SSL Certificates | On / off | No | Verify SSL certificates (recommended for production) |