Setup Elastic

Configure Elasticsearch to receive logs from logcannon.com with ECS-compliant field mappings

Elasticsearch Configuration
Configure Elasticsearch to receive logs from logcannon.com with ECS-compliant field mappings

Prerequisites

  • An Elasticsearch cluster (version 7.x or later recommended)
  • An API key with write permissions to create indices and index documents
  • Kibana access (optional, for viewing logs)

Step 1: Create an API Key in Elasticsearch

  1. Log into Kibana or access Elasticsearch directly
  2. Navigate to Stack Management → Security → API Keys (in Kibana) or use the Elasticsearch API
  3. Click Create API key
  4. Configure the API key:
    • Set a name (e.g., "logcannon")
    • Grant appropriate privileges:
Required privileges
cluster:monitor/main
indices:data/write/*
indices:data/write/index
  1. Optionally restrict to specific indices
  2. Copy the API key value - you'll need it for logcannon.com configuration

Security Note

Store your API key securely. The API key provides write access to your Elasticsearch cluster. Never share it publicly or commit it to version control.

Step 2: Configure in logcannon.com

In the logcannon.com interface, provide the following information:

Elasticsearch Endpoint URL

The URL for your Elasticsearch cluster, including the port (typically 9200).

Example
https://elasticsearch.example.com:9200

API Key

Paste the API key you created in Step 1. This key is encrypted and stored securely.

Index

The Elasticsearch index name where logs will be stored. Indices are created automatically if they don't exist.

Example
logcannon

SSL Verification

Enable SSL certificate verification for secure connections. Disable only if using self-signed certificates in development environments.

Kibana Web URL (Optional)

The URL for your Kibana instance to view logs. This enables direct links to Kibana queries.

Example
https://kibana.example.com:5601

Kibana Data View ID (Optional)

The data view ID in Kibana for your logcannon index. Get this from Kibana: Stack Management → Data Views → Click your logcannon* view → Copy ID from URL

Step 3: Test Connection

Use the "Test Connection" button in logcannon.com to verify your configuration. This will send a test event to your Elasticsearch cluster to ensure everything is working correctly.

ECS Compliance

Logs are sent to Elasticsearch in JSON format with ECS (Elastic Common Schema) compliant field mappings. This ensures compatibility with Elastic Security, SIEM, and other ECS-based tools.