Source Code

Go to your cloned repo:

cd /path/to/watchlog-agent
vim integration.json

Locate the Elasticsearch config:

{ "service": "elasticsearch", "monitor": false, "protocol": "http", "host": "127.0.0.1", "port": "9200", "username": "", "password": "", "apiKey": "", "verifyCertificate": true }

3. Update `"monitor"` to `true` and set the connection fields:
```diff
-  "monitor": false
+  "monitor": true

One reachable node is enough — the agent discovers the rest of the cluster from it:

{
  "service": "elasticsearch",
  "monitor": true,
  "protocol": "https",
  "host": "es-node-1.internal",
  "port": "9200",
  "username": "watchlog_monitor",
  "password": "your_password"
}

Restart the agent:
```
pm2 restart watchlog-agent
```

Verify without restarting

The connection test runs against the configuration in the file, so you can check it before reloading anything:

node -e "
const list = require('./integration.json');
const es = list.find(i => i.service === 'elasticsearch');
require('./app/integrations/elasticsearch/index').testConnection(es).then(r => console.log(r));
"

Or, once the agent is running, through its local API:

curl -s -X POST http://127.0.0.1:3774/integrations/elasticsearch/test | jq

Using an API key

An API key is the narrower credential and is preferred over basic auth. Create one scoped to monitoring only:

curl -u elastic -X POST "https://localhost:9200/_security/api_key" -H 'Content-Type: application/json' -d '{
  "name": "watchlog-agent",
  "role_descriptors": {
    "watchlog_monitor": {
      "cluster": ["monitor"],
      "indices": [{ "names": ["*"], "privileges": ["monitor"] }]
    }
  }
}'

Use the encoded value from the response:

{
  "service": "elasticsearch",
  "monitor": true,
  "protocol": "https",
  "host": "es.internal",
  "port": "9200",
  "apiKey": "VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw=="
}

The raw id:api_key pair works too — the agent encodes it for you.

Running the tests

The Elasticsearch collector's parsers, sanitizer, slow-log reader and client are covered by the agent's test suite, which needs no live cluster:

npm test

Development notes

The integration is advanced-only — there is no legacy collector beside it. Require it as require('./app/integrations/elasticsearch/index').
Every request is a GET, except the single POST that Cluster Allocation Explain requires. The client refuses any other method, so the integration structurally cannot mutate a cluster.
Sections are throttled independently: index and shard listings every 300s, topology and watermarks every 900s, tasks every 600s. advanced.collected in the payload records what a given scrape actually gathered.