Kubernetes

The Elasticsearch integration is configured through a mounted integration.json rather than env vars, because it carries nested advanced and slowlog objects that do not flatten cleanly into environment variables.

1. Create the ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: watchlog-integrations
  namespace: watchlog
data:
  integration.json: |
    [
      {
        "service": "elasticsearch",
        "monitor": true,
        "protocol": "https",
        "host": "elasticsearch-master.elastic.svc.cluster.local",
        "port": "9200",
        "username": "watchlog_monitor",
        "verifyCertificate": true,
        "tls": { "ca": "/certs/ca.crt" }
      }
    ]

One endpoint is enough. Pointing at the cluster's Service means any healthy node answers, and the agent discovers every other node, its roles and data tiers, from the cluster itself.

2. Keep the password out of the ConfigMap

Put the credential in a Secret and reference it as an env var, then let the agent read it through the config's env interpolation — or, more simply, mount the Secret and use an API key file. The minimal version:

apiVersion: v1
kind: Secret
metadata:
  name: watchlog-elasticsearch
  namespace: watchlog
type: Opaque
stringData:
  password: "your_password"

3. Mount it into the node agent

In your watchlog-node-agent.yaml, add the volume and mount:

      containers:
        - name: watchlog-agent
          image: watchlog/agent:latest
          env:
            - name: WATCHLOG_APIKEY
              valueFrom:
                secretKeyRef:
                  name: watchlog-credentials
                  key: apiKey
            - name: WATCHLOG_SERVER
              value: "https://log.watchlog.io"
            - name: ELASTICSEARCH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: watchlog-elasticsearch
                  key: password
          volumeMounts:
            - name: integrations
              mountPath: /app/app/config/integration.json
              subPath: integration.json
              readOnly: true
            - name: es-certs
              mountPath: /certs
              readOnly: true
      volumes:
        - name: integrations
          configMap:
            name: watchlog-integrations
        - name: es-certs
          secret:
            secretName: elasticsearch-master-certs

4. Apply

kubectl apply -f watchlog-integrations-configmap.yaml
kubectl apply -f watchlog-node-agent.yaml
kubectl rollout restart daemonset/watchlog-node-agent -n watchlog

Elastic Cloud on Kubernetes (ECK)

ECK generates the credentials and CA for you:

# The elastic user's password
kubectl get secret quickstart-es-elastic-user \
  -n elastic -o go-template='{{.data.elastic | base64decode}}'

# The HTTP CA certificate
kubectl get secret quickstart-es-http-certs-public \
  -n elastic -o go-template='{{index .data "ca.crt" | base64decode}}' > ca.crt

Rather than using elastic, create a dedicated monitoring user — the built-in monitoring_user role grants exactly the privileges Watchlog needs. Then point the agent at the ECK Service:

{
  "service": "elasticsearch",
  "monitor": true,
  "protocol": "https",
  "host": "quickstart-es-http.elastic.svc.cluster.local",
  "port": "9200",
  "username": "watchlog_monitor",
  "password": "your_password",
  "tls": { "ca": "/certs/ca.crt" }
}

Which agent should monitor the cluster?

The node agent runs as a DaemonSet, so a naive configuration has every node's agent polling Elasticsearch — N agents collecting the same cluster-wide metrics.

Watchlog identifies a cluster by its cluster UUID, so all of those agents write to the same integration and the data stays correct. But the polling is wasted. Two ways to avoid it:

• Preferred: run a single-replica Deployment of the agent dedicated to integrations, and keep the DaemonSet for host and container metrics only.
• Or use a node selector so only one node's agent carries the Elasticsearch entry in its ConfigMap.

Slow operations

Slow logs are files on each Elasticsearch pod's filesystem, not an API. Collecting them means the agent must be able to read that volume — which in practice means running the agent as a sidecar in the Elasticsearch pod with the log volume mounted, or mounting the same PVC.

For most Kubernetes deployments this is more trouble than it is worth. Everything else in the integration — cluster health, nodes, indices, shards, thread pools, circuit breakers, recovery — works without it.

Watchlog never enables slow logging for you. See the integration overview for what it stores and what it deliberately does not.