Docker Container

Create an integration.json file and mount it as a volume:

[
  {
    "service": "elasticsearch",
    "monitor": true,
    "protocol": "https",
    "host": "es-node-1.internal",
    "port": "9200",
    "username": "watchlog_monitor",
    "password": "your_password",
    "verifyCertificate": true
  }
]

Then run the container:

docker run -d \
  --name watchlog-agent \
  --network host \
  -v /path/to/integration.json:/app/app/config/integration.json \
  -e WATCHLOG_APIKEY="YOUR_APIKEY" \
  -e WATCHLOG_SERVER="https://log.watchlog.io" \
  watchlog/agent:latest

One endpoint is enough even for a multi-node cluster — the agent discovers every other node, its roles and data tiers, from the cluster itself.

Reaching Elasticsearch from the container

Elasticsearch runs…	Use
On the same host, agent on `--network host`	`127.0.0.1`
On the same host, agent on a bridge network	`host.docker.internal` (Docker Desktop) or the host's LAN IP
In another container on a shared user-defined network	The container or service name, e.g. `elasticsearch`
On a remote host	Its hostname or IP

If the agent and Elasticsearch share a Docker network, join it explicitly:

docker run -d \
  --name watchlog-agent \
  --network elastic \
  -v /path/to/integration.json:/app/app/config/integration.json \
  -e WATCHLOG_APIKEY="YOUR_APIKEY" \
  -e WATCHLOG_SERVER="https://log.watchlog.io" \
  watchlog/agent:latest

…and use the service name as the host:

{
  "service": "elasticsearch",
  "monitor": true,
  "host": "elasticsearch",
  "port": "9200",
  "username": "watchlog_monitor",
  "password": "your_password"
}

TLS with the cluster's CA

Mount the CA certificate into the container and point at the path inside the container:

docker run -d \
  --name watchlog-agent \
  --network elastic \
  -v /path/to/integration.json:/app/app/config/integration.json \
  -v /path/to/http_ca.crt:/certs/http_ca.crt:ro \
  -e WATCHLOG_APIKEY="YOUR_APIKEY" \
  -e WATCHLOG_SERVER="https://log.watchlog.io" \
  watchlog/agent:latest

{
  "service": "elasticsearch",
  "monitor": true,
  "protocol": "https",
  "host": "elasticsearch",
  "port": "9200",
  "username": "watchlog_monitor",
  "password": "your_password",
  "tls": { "ca": "/certs/http_ca.crt" }
}

Docker Compose

services:
  watchlog-agent:
    image: watchlog/agent:latest
    container_name: watchlog-agent
    restart: unless-stopped
    environment:
      WATCHLOG_APIKEY: "YOUR_APIKEY"
      WATCHLOG_SERVER: "https://log.watchlog.io"
    volumes:
      - ./integration.json:/app/app/config/integration.json:ro
      - ./certs/http_ca.crt:/certs/http_ca.crt:ro
    networks:
      - elastic

networks:
  elastic:
    external: true

Multiple Elasticsearch Clusters

Add multiple entries with the same service name. Each cluster is identified by its cluster UUID, so the same cluster reached through a different endpoint stays one integration:

[
  {
    "service": "elasticsearch",
    "monitor": true,
    "host": "es-prod.internal",
    "port": "9200",
    "username": "watchlog_monitor",
    "password": "your_password"
  },
  {
    "service": "elasticsearch",
    "monitor": true,
    "protocol": "https",
    "host": "es-analytics.internal",
    "port": "9243",
    "apiKey": "VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw=="
  }
]

Slow operations in Docker

Slow logs are files on each Elasticsearch node's host, not an API — so the agent has to be able to read them. Mount the Elasticsearch log directory read-only:

  -v /var/lib/docker/volumes/es-logs/_data:/es-logs:ro

"slowlog": {
  "enabled": true,
  "logDirectories": ["/es-logs"],
  "storeSource": false
}

If Elasticsearch runs on a different host from the agent, run an agent on that host instead — there is no remote API for slow logs.

Watchlog never enables slow logging for you. Set the threshold yourself on the indices you want traced; see the integration overview.