Skip to main content
Configure Elasticsearch export to send audit logs to your Elasticsearch cluster for search, analytics, and long-term retention.

Prerequisites

  • Golf Gateway deployed and running
  • Elasticsearch cluster (self-hosted or Elastic Cloud)
  • API key with write permissions - See Create API keys in Elastic documentation
Required API key privileges on golf-gateway-* indices:
  • write
  • create_index
  • manage

Configure Elasticsearch export

Self-Hosted Elasticsearch:
Elastic Cloud:

Index naming

Golf Gateway creates daily indices with the pattern:
Example: golf-gateway-2026.01.08

Index mapping

The index mapping is created automatically with these key fields:

Verify export is working

  1. Check gateway health:
  2. Generate some traffic, then search in Kibana:

Troubleshooting

  • Connection refused: Verify Elasticsearch URL and network connectivity
  • 401 Unauthorized: Check API key has correct permissions
  • Index not created: Verify API key has create_index privilege