---
title: Elasticsearch
description: Connect PingOne Privilege to Elasticsearch clusters and indices through the MCP Catalog.
component: privilege
page_id: privilege:agent-privilege:configuration/agentic-apps/elasticsearch
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/agentic-apps/elasticsearch.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 10, 2026
section_ids:
  configure-an-elasticsearch-integration: Configure an Elasticsearch integration
  before-you-begin: Before you begin
  step-1-create-an-elasticsearch-application-in-pingone-privilege: "Step 1: Create an Elasticsearch application in PingOne Privilege"
  step-2-configure-policies-for-elasticsearch-tools: "Step 2: Configure policies for Elasticsearch tools"
  step-3-establish-connectivity-between-agent-and-gateway: "Step 3: Establish connectivity between agent and gateway"
  result: Result
---

# Elasticsearch

The MCP Catalog provides a prebuilt integration for Elasticsearch clusters and indices.

This integration provides:

* Tools for working with Elasticsearch clusters, indices, and queries.

* Tool, prompt, and resource-level PingOne Privilege policy configuration.

* Full audit of agent tool calls in **Activity > Activity Logs**.

## Configure an Elasticsearch integration

Configuration involves creating an Elasticsearch application in PingOne Privilege, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

### Before you begin

Ensure you have the following:

* An AI gateway configured in Directory > Gateways. Learn more in [AI gateways](../ai-gateways.html).

* You have the Elasticsearch cluster endpoint and credentials for a user with the required index permissions.

### Step 1: Create an Elasticsearch application in PingOne Privilege

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. Click the **MCP Catalog** tab.

3. In the **Elasticsearch** tile, click **Add** **[icon: plus, set=fa]**.

4. Enter an **Application Name** for the connection.

5. Select a **Mesh Cluster**.

6. Provide the required **Elasticsearch URL** and **API Key**.

7. In the **Username** field, enter your Elasticsearch username.

8. In the **Password** field, enter your Elasticsearch password.

9. Click **Create**.

The Elasticsearch integration is now available to AI agents as an MCP server, with PingOne Privilege policy applied to its tools.

### Step 2: Configure policies for Elasticsearch tools

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. In the list, find the **Elasticsearch** application.

3. Click **(⋮)**, then click **Create Policy**.

4. Select which operations from the Elasticsearch specification are available to agents.

5. Click **Update Configuration**.

6. Add the users or groups the policy will apply to.

7. Define the users or groups the policy will apply to.

8. Click **Continue**.

9. Configure the policy with the following fields:

   * **Policy Name**

   * **Select Timezone**

   * **Start Date** and **Start Time**

   * **End Date** in hours, days, weeks, months, or custom date.

10. Click **Submit** to save the policy.

### Step 3: Establish connectivity between agent and gateway

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. On the **Active Applications** tab, find the **Elasticsearch** application and click **More Info**.

3. On the **Overview** tab's **Resource Information** section, select a configured **AI Gateway** from the list.

4. Copy the **MCP Config** code.

5. Use the code you just copied to connect to the **Elasticsearch** app through your client. For example, you can paste the code into Claude Desktop.

   **Result:** The associated **Elasticsearch** app is now accessible through that client.

6. Validate that the Elasticsearch tools appear in the client and that restricted tools don't appear.

### Result

Users can now get the **MCP Config** for connecting their client to the **Elasticsearch** app under **Agentic Apps** in the PingOne Privilege user console.