Elasticsearch API: what you can do and how to use it with AI agents
Elasticsearch is a search and analytics engine with a REST API to index documents, search, aggregate and administer the cluster. Engineering, observability and product teams use it for search, logs and metrics. Access is through an API key or a user with roles defined in the cluster itself.
What the Elasticsearch API offers
Indices
Creating indices, mappings and settings.
Documents
Adding, updating and deleting documents, including in bulk.
Search
Text queries, filters and sorting with the Query DSL.
Aggregations
Counts, averages and distributions over the data.
Vector search
Similarity search with vectors, in the versions that support it.
Cluster health
State of nodes, shards and indices.
How to access the Elasticsearch API
- With your company’s credentialsAn API key, or a username and password with Elasticsearch roles that limit indices and actions. On Elastic Cloud, the endpoint is the one for your deployment.
- Heavy queries can affect the cluster, so set time and size limits.
- Logs can hold personal data or secrets, so handle them under your data-protection law.
- Restrict the key by index instead of granting global access.
Official documentation: www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html
What an iTeam agent does with the Elasticsearch API
Production error investigation
When an alert fires, the agent searches the logs for the error pattern, aggregates by service and version, and summarizes for the on-call engineer.
Question about customer behavior
Support asks what a user did before the error, and the agent queries the indexed events of that session.
Cluster in yellow
The agent checks cluster health and reports which indices have unassigned shards.
Better site search
The agent analyzes searches with no results and suggests synonyms for the product team.
From the credential to the agent at work, with approval
Create a restricted API key
Limit the key to the indices needed and to read-only, when possible.
Store it in the iTeam vault
The key and the endpoint stay in the vault, with network access approved by IT.
Test with approval
Writes, deletions and index changes go through human approval.
Ready-made AI teams for this work
Management reporting team
Revenue, margin, pipeline and cash in one report, built from your systems, with a short note on what changed and why.
Data analysis team
Ask which customers stopped buying or which region lost margin. The team writes the SQL, runs it and explains the result.
IT service desk team
Password resets, access requests and how-to questions handled in chat, with Jira updated and approvals in place.
Questions about the Elasticsearch API
Is the Elasticsearch API free?
It depends. Elasticsearch has a free distribution for your own use, and Elastic Cloud and advanced features are paid under a subscription.
Do I need to code to use the Elasticsearch API with iTeam?
Not necessarily. iTeam's HTTP tool reads the documentation, and the deployment team sets up the queries with your team.
Does it work with OpenSearch?
Many calls are similar but not identical. iTeam uses the documentation of the system you have.
