Windows

Open the config file:

C:\Program Files\watchlog-agent\integration.json

Locate the Elasticsearch section:

{ "service": "elasticsearch", "monitor": false, "protocol": "http", "host": "127.0.0.1", "port": "9200", "username": "", "password": "", "apiKey": "", "verifyCertificate": true }

3. Change `"monitor"` to `true`:
```diff
-  "monitor": false
+  "monitor": true

Populate the connection fields:

protocol — http or https
host, port — one reachable node is enough; the agent discovers the rest of the cluster
username / password or apiKey

{
  "service": "elasticsearch",
  "monitor": true,
  "protocol": "https",
  "host": "es-node-1.internal",
  "port": "9200",
  "username": "watchlog_monitor",
  "password": "your_password"
}

Restart the service:
```
Restart-Service -Name "WatchlogAgent"
```

Verify the connection

Invoke-RestMethod -Method Post -Uri "http://127.0.0.1:3774/integrations/elasticsearch/test" | ConvertTo-Json -Depth 4

A working configuration reports the cluster name, version, node count and status. Anything else names the specific problem — connection_refused, authentication_failed, permission_denied, tls_error, timeout or unsupported_endpoint. Your password is never echoed back.

TLS with a private CA

Use a Windows path to the CA certificate:

{
  "service": "elasticsearch",
  "monitor": true,
  "protocol": "https",
  "host": "es.internal",
  "port": "9200",
  "username": "watchlog_monitor",
  "password": "your_password",
  "tls": {
    "ca": "C:\\ProgramData\\Elastic\\certs\\http_ca.crt"
  }
}

Remember to escape backslashes in JSON.

Slow operations (optional)

On Windows, Elasticsearch usually writes its logs under:

C:\ProgramData\Elastic\Elasticsearch\logs\

That is outside the directories the agent scans by default, so set the paths explicitly:

"slowlog": {
  "enabled": true,
  "searchLogPath": "C:\\ProgramData\\Elastic\\Elasticsearch\\logs\\production_index_search_slowlog.json",
  "indexingLogPath": "C:\\ProgramData\\Elastic\\Elasticsearch\\logs\\production_index_indexing_slowlog.json",
  "storeSource": false
}

The file name is prefixed with your cluster name, so check the actual directory listing first.

Watchlog never enables slow logging for you — you must set a threshold on the indices you want traced. See the integration overview for the settings and for what Watchlog does and does not store from a slow log.