--- title: ElasticSearch description: Resource path: component: pingam version: 7.2 page_id: pingam:entity-reference:sec-amster-entity-elasticsearch canonical_url: https://docs.pingidentity.com/pingam/8.1/entity-reference/sec-amster-entity-elasticsearch.html llms_txt: https://docs.pingidentity.com/pingam/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md superseded_by: https://docs.pingidentity.com/pingam/8.1/entity-reference/sec-amster-entity-elasticsearch.html section_ids: sec-amster-entity-elasticsearch-realm-ops: Realm Operations sec-amster-entity-elasticsearch-realm-ops-create: create sec-amster-entity-elasticsearch-realm-ops-delete: delete sec-amster-entity-elasticsearch-realm-ops-getalltypes: getAllTypes sec-amster-entity-elasticsearch-realm-ops-getcreatabletypes: getCreatableTypes sec-amster-entity-elasticsearch-realm-ops-nextdescendents: nextdescendents sec-amster-entity-elasticsearch-realm-ops-query: query sec-amster-entity-elasticsearch-realm-ops-read: read sec-amster-entity-elasticsearch-realm-ops-update: update sec-amster-entity-elasticsearch-global-ops: Global Operations sec-amster-entity-elasticsearch-global-ops-create: create sec-amster-entity-elasticsearch-global-ops-delete: delete sec-amster-entity-elasticsearch-global-ops-getalltypes: getAllTypes sec-amster-entity-elasticsearch-global-ops-getcreatabletypes: getCreatableTypes sec-amster-entity-elasticsearch-global-ops-nextdescendents: nextdescendents sec-amster-entity-elasticsearch-global-ops-query: query sec-amster-entity-elasticsearch-global-ops-read: read sec-amster-entity-elasticsearch-global-ops-update: update --- # ElasticSearch ## Realm Operations Resource path: ``` /realm-config/services/audit/Elasticsearch ``` Resource version: `1.0` ### create **Usage** ``` am> create ElasticSearch --realm Realm --id id --body body ``` **Parameters** * *\--id* The unique identifier for the resource. * *\--body* The resource in JSON format, described by the following JSON schema: ```json { "type" : "object", "properties" : { "elasticsearchBuffering" : { "type" : "object", "title" : "Buffering", "propertyOrder" : 4, "properties" : { "writeInterval" : { "title" : "Write interval (in milliseconds)", "description" : "Specifies the interval in milliseconds at which buffered events are written to Elasticsearch.", "propertyOrder" : 6000, "required" : true, "type" : "integer", "exampleValue" : "" }, "maxEvents" : { "title" : "Queue Capacity", "description" : "Maximum number of audit logs in the batch queue. Additional audit events are dropped.", "propertyOrder" : 5900, "required" : true, "type" : "integer", "exampleValue" : "" }, "batchSize" : { "title" : "Batch Size", "description" : "Maximum number of events that can be buffered (default: 10000)", "propertyOrder" : 5800, "required" : true, "type" : "integer", "exampleValue" : "" }, "bufferingEnabled" : { "title" : "Buffering Enabled", "description" : "", "propertyOrder" : 5700, "required" : true, "type" : "boolean", "exampleValue" : "" } } }, "elasticsearchConfig" : { "type" : "object", "title" : "Elasticsearch Configuration", "propertyOrder" : 2, "properties" : { "index" : { "title" : "Elasticsearch Index", "description" : "Specifies the name of the Elasticsearch index to be used for OpenAM audit logging.", "propertyOrder" : 5400, "required" : true, "type" : "string", "exampleValue" : "" }, "port" : { "title" : "Server Port", "description" : "Specifies the port number used to access Elasticsearch's REST API.", "propertyOrder" : 5200, "required" : true, "type" : "integer", "exampleValue" : "" }, "host" : { "title" : "Server Hostname", "description" : "Host name or IP address of the Elasticsearch server.", "propertyOrder" : 5100, "required" : true, "type" : "string", "exampleValue" : "" }, "sslEnabled" : { "title" : "SSL Enabled", "description" : "Specifies whether SSL is configured on the Elasticsearch server.

If SSL is enabled, be sure to import the CA certificate used to sign Elasticsearch node certificates into the Java keystore on the host that runs OpenAM before attempting to log audit events to Elasticsearch.", "propertyOrder" : 5300, "required" : true, "type" : "boolean", "exampleValue" : "" } } }, "commonHandler" : { "type" : "object", "title" : "General Handler Configuration", "propertyOrder" : 0, "properties" : { "enabled" : { "title" : "Enabled", "description" : "Enables or disables an audit event handler.", "propertyOrder" : 4900, "required" : true, "type" : "boolean", "exampleValue" : "" }, "topics" : { "title" : "Topics", "description" : "List of topics handled by an audit event handler.", "propertyOrder" : 5000, "required" : true, "items" : { "type" : "string" }, "type" : "array", "exampleValue" : "" } } }, "elasticsearchAuthentication" : { "type" : "object", "title" : "Authentication", "propertyOrder" : 3, "properties" : { "username" : { "title" : "Username", "description" : "Specifies the username to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5500, "required" : true, "type" : "string", "exampleValue" : "" }, "password" : { "title" : "Password", "description" : "Specifies the password to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5600, "required" : true, "type" : "string", "format" : "password", "exampleValue" : "" } } }, "commonHandlerPlugin" : { "type" : "object", "title" : "Audit Event Handler Factory", "propertyOrder" : 1, "properties" : { "handlerFactory" : { "title" : "Factory Class Name", "description" : "The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.", "propertyOrder" : 6100, "required" : true, "type" : "string", "exampleValue" : "" } } } } } ``` ### delete **Usage** ``` am> delete ElasticSearch --realm Realm --id id ``` **Parameters** * *\--id* The unique identifier for the resource. ### getAllTypes Obtain the collection of all secondary configuration types related to the resource. **Usage** ``` am> action ElasticSearch --realm Realm --actionName getAllTypes ``` ### getCreatableTypes Obtain the collection of secondary configuration types that have yet to be added to the resource. **Usage** ``` am> action ElasticSearch --realm Realm --actionName getCreatableTypes ``` ### nextdescendents Obtain the collection of secondary configuration instances that have been added to the resource. **Usage** ``` am> action ElasticSearch --realm Realm --actionName nextdescendents ``` ### query Get the full list of instances of this collection. This query only supports `_queryFilter=true` filter. **Usage** ``` am> query ElasticSearch --realm Realm --filter filter ``` **Parameters** * *\--filter* A CREST formatted query filter, where "true" will query all. ### read **Usage** ``` am> read ElasticSearch --realm Realm --id id ``` **Parameters** * *\--id* The unique identifier for the resource. ### update **Usage** ``` am> update ElasticSearch --realm Realm --id id --body body ``` **Parameters** * *\--id* The unique identifier for the resource. * *\--body* The resource in JSON format, described by the following JSON schema: ```json { "type" : "object", "properties" : { "elasticsearchBuffering" : { "type" : "object", "title" : "Buffering", "propertyOrder" : 4, "properties" : { "writeInterval" : { "title" : "Write interval (in milliseconds)", "description" : "Specifies the interval in milliseconds at which buffered events are written to Elasticsearch.", "propertyOrder" : 6000, "required" : true, "type" : "integer", "exampleValue" : "" }, "maxEvents" : { "title" : "Queue Capacity", "description" : "Maximum number of audit logs in the batch queue. Additional audit events are dropped.", "propertyOrder" : 5900, "required" : true, "type" : "integer", "exampleValue" : "" }, "batchSize" : { "title" : "Batch Size", "description" : "Maximum number of events that can be buffered (default: 10000)", "propertyOrder" : 5800, "required" : true, "type" : "integer", "exampleValue" : "" }, "bufferingEnabled" : { "title" : "Buffering Enabled", "description" : "", "propertyOrder" : 5700, "required" : true, "type" : "boolean", "exampleValue" : "" } } }, "elasticsearchConfig" : { "type" : "object", "title" : "Elasticsearch Configuration", "propertyOrder" : 2, "properties" : { "index" : { "title" : "Elasticsearch Index", "description" : "Specifies the name of the Elasticsearch index to be used for OpenAM audit logging.", "propertyOrder" : 5400, "required" : true, "type" : "string", "exampleValue" : "" }, "port" : { "title" : "Server Port", "description" : "Specifies the port number used to access Elasticsearch's REST API.", "propertyOrder" : 5200, "required" : true, "type" : "integer", "exampleValue" : "" }, "host" : { "title" : "Server Hostname", "description" : "Host name or IP address of the Elasticsearch server.", "propertyOrder" : 5100, "required" : true, "type" : "string", "exampleValue" : "" }, "sslEnabled" : { "title" : "SSL Enabled", "description" : "Specifies whether SSL is configured on the Elasticsearch server.

If SSL is enabled, be sure to import the CA certificate used to sign Elasticsearch node certificates into the Java keystore on the host that runs OpenAM before attempting to log audit events to Elasticsearch.", "propertyOrder" : 5300, "required" : true, "type" : "boolean", "exampleValue" : "" } } }, "commonHandler" : { "type" : "object", "title" : "General Handler Configuration", "propertyOrder" : 0, "properties" : { "enabled" : { "title" : "Enabled", "description" : "Enables or disables an audit event handler.", "propertyOrder" : 4900, "required" : true, "type" : "boolean", "exampleValue" : "" }, "topics" : { "title" : "Topics", "description" : "List of topics handled by an audit event handler.", "propertyOrder" : 5000, "required" : true, "items" : { "type" : "string" }, "type" : "array", "exampleValue" : "" } } }, "elasticsearchAuthentication" : { "type" : "object", "title" : "Authentication", "propertyOrder" : 3, "properties" : { "username" : { "title" : "Username", "description" : "Specifies the username to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5500, "required" : true, "type" : "string", "exampleValue" : "" }, "password" : { "title" : "Password", "description" : "Specifies the password to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5600, "required" : true, "type" : "string", "format" : "password", "exampleValue" : "" } } }, "commonHandlerPlugin" : { "type" : "object", "title" : "Audit Event Handler Factory", "propertyOrder" : 1, "properties" : { "handlerFactory" : { "title" : "Factory Class Name", "description" : "The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.", "propertyOrder" : 6100, "required" : true, "type" : "string", "exampleValue" : "" } } } } } ``` ## Global Operations Resource path: ``` /global-config/services/audit/Elasticsearch ``` Resource version: `1.0` ### create **Usage** ``` am> create ElasticSearch --global --id id --body body ``` **Parameters** * *\--id* The unique identifier for the resource. * *\--body* The resource in JSON format, described by the following JSON schema: ```json { "type" : "object", "properties" : { "elasticsearchBuffering" : { "type" : "object", "title" : "Buffering", "propertyOrder" : 4, "properties" : { "batchSize" : { "title" : "Batch Size", "description" : "Maximum number of events that can be buffered (default: 10000)", "propertyOrder" : 5800, "required" : true, "type" : "integer", "exampleValue" : "" }, "maxEvents" : { "title" : "Queue Capacity", "description" : "Maximum number of audit logs in the batch queue. Additional audit events are dropped.", "propertyOrder" : 5900, "required" : true, "type" : "integer", "exampleValue" : "" }, "writeInterval" : { "title" : "Write interval (in milliseconds)", "description" : "Specifies the interval in milliseconds at which buffered events are written to Elasticsearch.", "propertyOrder" : 6000, "required" : true, "type" : "integer", "exampleValue" : "" }, "bufferingEnabled" : { "title" : "Buffering Enabled", "description" : "", "propertyOrder" : 5700, "required" : true, "type" : "boolean", "exampleValue" : "" } } }, "commonHandlerPlugin" : { "type" : "object", "title" : "Audit Event Handler Factory", "propertyOrder" : 1, "properties" : { "handlerFactory" : { "title" : "Factory Class Name", "description" : "The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.", "propertyOrder" : 6100, "required" : true, "type" : "string", "exampleValue" : "" } } }, "elasticsearchAuthentication" : { "type" : "object", "title" : "Authentication", "propertyOrder" : 3, "properties" : { "password" : { "title" : "Password", "description" : "Specifies the password to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5600, "required" : true, "type" : "string", "format" : "password", "exampleValue" : "" }, "username" : { "title" : "Username", "description" : "Specifies the username to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5500, "required" : true, "type" : "string", "exampleValue" : "" } } }, "elasticsearchConfig" : { "type" : "object", "title" : "Elasticsearch Configuration", "propertyOrder" : 2, "properties" : { "sslEnabled" : { "title" : "SSL Enabled", "description" : "Specifies whether SSL is configured on the Elasticsearch server.

If SSL is enabled, be sure to import the CA certificate used to sign Elasticsearch node certificates into the Java keystore on the host that runs OpenAM before attempting to log audit events to Elasticsearch.", "propertyOrder" : 5300, "required" : true, "type" : "boolean", "exampleValue" : "" }, "index" : { "title" : "Elasticsearch Index", "description" : "Specifies the name of the Elasticsearch index to be used for OpenAM audit logging.", "propertyOrder" : 5400, "required" : true, "type" : "string", "exampleValue" : "" }, "host" : { "title" : "Server Hostname", "description" : "Host name or IP address of the Elasticsearch server.", "propertyOrder" : 5100, "required" : true, "type" : "string", "exampleValue" : "" }, "port" : { "title" : "Server Port", "description" : "Specifies the port number used to access Elasticsearch's REST API.", "propertyOrder" : 5200, "required" : true, "type" : "integer", "exampleValue" : "" } } }, "commonHandler" : { "type" : "object", "title" : "General Handler Configuration", "propertyOrder" : 0, "properties" : { "enabled" : { "title" : "Enabled", "description" : "Enables or disables an audit event handler.", "propertyOrder" : 4900, "required" : true, "type" : "boolean", "exampleValue" : "" }, "topics" : { "title" : "Topics", "description" : "List of topics handled by an audit event handler.", "propertyOrder" : 5000, "required" : true, "items" : { "type" : "string" }, "type" : "array", "exampleValue" : "" } } } } } ``` ### delete **Usage** ``` am> delete ElasticSearch --global --id id ``` **Parameters** * *\--id* The unique identifier for the resource. ### getAllTypes Obtain the collection of all secondary configuration types related to the resource. **Usage** ``` am> action ElasticSearch --global --actionName getAllTypes ``` ### getCreatableTypes Obtain the collection of secondary configuration types that have yet to be added to the resource. **Usage** ``` am> action ElasticSearch --global --actionName getCreatableTypes ``` ### nextdescendents Obtain the collection of secondary configuration instances that have been added to the resource. **Usage** ``` am> action ElasticSearch --global --actionName nextdescendents ``` ### query Get the full list of instances of this collection. This query only supports `_queryFilter=true` filter. **Usage** ``` am> query ElasticSearch --global --filter filter ``` **Parameters** * *\--filter* A CREST formatted query filter, where "true" will query all. ### read **Usage** ``` am> read ElasticSearch --global --id id ``` **Parameters** * *\--id* The unique identifier for the resource. ### update **Usage** ``` am> update ElasticSearch --global --id id --body body ``` **Parameters** * *\--id* The unique identifier for the resource. * *\--body* The resource in JSON format, described by the following JSON schema: ```json { "type" : "object", "properties" : { "elasticsearchBuffering" : { "type" : "object", "title" : "Buffering", "propertyOrder" : 4, "properties" : { "batchSize" : { "title" : "Batch Size", "description" : "Maximum number of events that can be buffered (default: 10000)", "propertyOrder" : 5800, "required" : true, "type" : "integer", "exampleValue" : "" }, "maxEvents" : { "title" : "Queue Capacity", "description" : "Maximum number of audit logs in the batch queue. Additional audit events are dropped.", "propertyOrder" : 5900, "required" : true, "type" : "integer", "exampleValue" : "" }, "writeInterval" : { "title" : "Write interval (in milliseconds)", "description" : "Specifies the interval in milliseconds at which buffered events are written to Elasticsearch.", "propertyOrder" : 6000, "required" : true, "type" : "integer", "exampleValue" : "" }, "bufferingEnabled" : { "title" : "Buffering Enabled", "description" : "", "propertyOrder" : 5700, "required" : true, "type" : "boolean", "exampleValue" : "" } } }, "commonHandlerPlugin" : { "type" : "object", "title" : "Audit Event Handler Factory", "propertyOrder" : 1, "properties" : { "handlerFactory" : { "title" : "Factory Class Name", "description" : "The fully qualified class name of the factory responsible for creating the Audit Event Handler. The class must implement org.forgerock.openam.audit.AuditEventHandlerFactory.", "propertyOrder" : 6100, "required" : true, "type" : "string", "exampleValue" : "" } } }, "elasticsearchAuthentication" : { "type" : "object", "title" : "Authentication", "propertyOrder" : 3, "properties" : { "password" : { "title" : "Password", "description" : "Specifies the password to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5600, "required" : true, "type" : "string", "format" : "password", "exampleValue" : "" }, "username" : { "title" : "Username", "description" : "Specifies the username to access the Elasticsearch server.

Required if Elasticsearch Shield authentication is configured.", "propertyOrder" : 5500, "required" : true, "type" : "string", "exampleValue" : "" } } }, "elasticsearchConfig" : { "type" : "object", "title" : "Elasticsearch Configuration", "propertyOrder" : 2, "properties" : { "sslEnabled" : { "title" : "SSL Enabled", "description" : "Specifies whether SSL is configured on the Elasticsearch server.

If SSL is enabled, be sure to import the CA certificate used to sign Elasticsearch node certificates into the Java keystore on the host that runs OpenAM before attempting to log audit events to Elasticsearch.", "propertyOrder" : 5300, "required" : true, "type" : "boolean", "exampleValue" : "" }, "index" : { "title" : "Elasticsearch Index", "description" : "Specifies the name of the Elasticsearch index to be used for OpenAM audit logging.", "propertyOrder" : 5400, "required" : true, "type" : "string", "exampleValue" : "" }, "host" : { "title" : "Server Hostname", "description" : "Host name or IP address of the Elasticsearch server.", "propertyOrder" : 5100, "required" : true, "type" : "string", "exampleValue" : "" }, "port" : { "title" : "Server Port", "description" : "Specifies the port number used to access Elasticsearch's REST API.", "propertyOrder" : 5200, "required" : true, "type" : "integer", "exampleValue" : "" } } }, "commonHandler" : { "type" : "object", "title" : "General Handler Configuration", "propertyOrder" : 0, "properties" : { "enabled" : { "title" : "Enabled", "description" : "Enables or disables an audit event handler.", "propertyOrder" : 4900, "required" : true, "type" : "boolean", "exampleValue" : "" }, "topics" : { "title" : "Topics", "description" : "List of topics handled by an audit event handler.", "propertyOrder" : 5000, "required" : true, "items" : { "type" : "string" }, "type" : "array", "exampleValue" : "" } } } } } ```