> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Linking Elasticsearch as a source

Canonical URL: https://posthog.com/docs/data-pipelines/sources/elasticsearch

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://app.posthog.com` (app host for links).

## On this page

- [Available tables](#available-tables)
- [Linking Elasticsearch](#linking-elasticsearch)
- [Authentication](#authentication)
- [Sync method](#sync-method)
- [Configuration](#configuration)
- [Supported tables](#supported-tables)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d)

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

`npx @posthog/wizard warehouse`

![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)

![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you

The Elasticsearch connector syncs data from your Elasticsearch cluster into the PostHog data warehouse. Each non-system index and data stream in your cluster becomes a separate table you can query alongside your PostHog data.

## Available tables

Tables are dynamically discovered from your Elasticsearch cluster rather than being predefined. When you connect a cluster, PostHog lists all non-system indices and non-hidden, non-system [data streams](https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams.html). System indices (those starting with `.` like `.kibana`) and hidden or system data streams are filtered out.

For each index:

-   The Elasticsearch `_id` field becomes the primary key
-   All fields from `_source` become columns

For each data stream:

-   The primary key is a composite of `_index` and `_id`, because `_id` is only unique within a single backing index
-   Each row includes an `_index` column identifying the backing index, plus all fields from `_source`

> **Note:** Data stream discovery requires Elasticsearch 7.9 or later and credentials with the `view_index_metadata` privilege. If either requirement isn't met, data streams won't appear but index discovery still works normally.

## Linking Elasticsearch

1.  Go to the [Data pipeline page](https://app.posthog.com/data-management/sources) and the sources tab in PostHog.
2.  Click **New source** and select **Elasticsearch**.
3.  Enter your Elasticsearch cluster URL (e.g., `https://my-deployment.es.us-east-1.aws.found.io:9243`). If you omit the scheme, `https://` is used by default.
4.  Choose your authentication method:
    -   **Username and password** – enter your Elasticsearch username and password.
    -   **API key** – enter your Elasticsearch API key.
5.  *Optional:* Add a prefix to your table names.
6.  Click **Next**, select the indices and data streams to sync, then click **Link**.

The data warehouse then starts syncing your Elasticsearch data. You can see details and progress in the [data pipeline sources tab](https://app.posthog.com/data-management/sources).

## Authentication

Elasticsearch supports two authentication methods:

-   **Username and password** – uses HTTP basic authentication against your Elasticsearch cluster.
-   **API key** – uses the `Authorization: ApiKey` header for token-based authentication.

The account or API key needs **read** access to the indices you want to sync. To discover data streams, the credentials also need the `view_index_metadata` privilege.

## Sync method

Elasticsearch uses **full refresh** sync only. Each sync re-reads the entire index or data stream because Elasticsearch indices don't have a reliable timestamp field to use as a cursor for incremental sync, and a data stream's `@timestamp` format varies by client.

## Configuration

| Option | Type | Required |
| --- | --- | --- |
| `Cluster URL` | text | Yes |
| `Authentication method` | select | Yes |

## Supported tables

The tables available from this source are discovered from your account when you connect it, so the exact list depends on your data. Once connected, you can pick which tables to sync from the [sources tab](https://app.posthog.com/data-management/sources).