Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Manage the data and application connections behind your search experience. Use the Azure resource to find endpoints and open Elastic, then manage indexes, ingest content, and explore search results in Elasticsearch and Kibana.
Start with Manage search data. Azure log forwarding is an optional data source, not a prerequisite for application search.
Manage your vector retrieval workflow from the Get started with Elastic Vector Database section on the resource overview. Its three tiles take you to document ingestion and automatic embedding, natural-language chat in Elastic Agent Builder, and semantic queries in Dev Tools.
Start with Work with your vector data. Your project is serverless, so the core workflow is managing data and retrieval rather than configuring cluster versions or sizes.
Manage telemetry collection and monitoring coverage for your applications and infrastructure. Use Azure to control which resources send platform logs, and use Elastic to configure APM and other integrations, explore logs, metrics, and traces, and manage dashboards and alerts.
Start with Monitor applications and infrastructure.
Manage the data sources that support threat detection and investigation. Use Azure to control platform log collection and subscription coverage, and use Elastic Security to manage security integrations, detection rules, alerts, and investigations.
Start with Manage security coverage and investigations.
Resource overview
Begin by signing in to the Azure portal.
In the Azure portal search bar, enter All resources and select All resources from the results.
From the Resources list, select your resource.
The Azure portal shows the resource with the Overview page open, by default.
The Essentials section identifies your resource group, region, subscription, and billing term. Use the Elasticsearch endpoint for API access. The available links to Kibana and Elastic Cloud vary by hosting type; Advanced Settings opens management in Elastic Cloud.
Elastic Search, Elastic Observability, and Elastic Security resources are available as Serverless and Cloud Hosted. Elastic Vector Database is serverless only. For more information, see Compare Elastic Cloud Hosted and Serverless.
Manage search data
Use your resource overview to connect applications, add searchable content, and inspect your indexes. Cloud Hosted resources also show the Elasticsearch version and cluster size; serverless resources show their project type.
Cloud Hosted resource:
Serverless resource:
Add and explore searchable content
- Select Add more data sources in Elastic to configure an integration, or use the Elasticsearch endpoint to ingest documents through the API.
- Select View and manage your data in Elastic to open Kibana and inspect your indexes and documents.
- Run queries against your data and refine your index mappings and search queries in Elastic to meet your application's needs.
Use Advanced Settings to manage the deployment in Elastic Cloud, including version and capacity changes for Cloud Hosted resources.
If Azure platform logs are part of your search workload, select Ingest logs and metrics from Azure Services to configure forwarding. This step doesn't ingest documents from your application or content store.
Work with your vector data
The overview identifies the project as Type: VectorDB. Below Essentials, Get started with Elastic Vector Database presents three tiles for working with your documents. These tiles replace the general log-ingestion and data-source tiles shown for the other offers.
Ingest and auto-embed your data
- On the Ingest and auto-embed your data tile, select Add data & embed.
- In the Elastic onboarding flow, add your documents and follow the steps to index them. Elastic generates embeddings automatically by using
semantic_textand Jina models. - Wait for ingestion to complete before querying or chatting with the data. Note your index name and the field used for semantic search.
Azure Logs & metrics settings control platform log forwarding. They don't upload your documents or configure their embeddings.
Chat with your data
- On the Chat with your data tile, select Open Agent Builder.
- Use Elastic Agent Builder to ask a natural-language question about the documents you ingested.
- Review the answer against your source content and refine your questions or data as needed.
Elastic Agent Builder is the conversational experience for your data. It's different from Elastic Agent, which collects telemetry from virtual machines.
Query your data in Dev Tools
- On the Query your data in Dev Tools tile, select Open in Dev Tools.
- Review the prefilled semantic search example. Scope it to your index, use the semantic field name from your documents, and replace the example question with one relevant to your data.
- Run the query and inspect the returned documents to evaluate retrieval before using it in your application.
Note
The built-in embedding workflow doesn't require the Azure OpenAI connector. Azure OpenAI integration configures a text or chat completion connector for Elastic's AI Assistant, not an embedding model for your documents.
Monitor applications and infrastructure
Use the overview entry points according to the telemetry you need:
| Entry point | Observability task |
|---|---|
| Ingest logs and metrics from Azure Services | Select the Azure platform logs to forward and maintain tag-based collection rules |
| Add more data sources in Elastic | Configure APM, infrastructure monitoring, or other integrations to collect application telemetry |
| View and manage your data in Elastic | Explore logs, metrics, and traces, and create dashboards and alerts |
Maintain telemetry coverage
- Review Monitored resources to check which Azure resources are sending logs. If expected resources are missing, review their tags and the log forwarding rules.
- Use Monitored Subscriptions to extend platform log collection across the subscriptions that host your applications.
- Configure the relevant Elastic integrations or deploy Elastic Agent when you need telemetry beyond Azure diagnostic logs.
- In Elastic, confirm that the required telemetry is arriving and update dashboards and alert rules as applications change.
Note
Azure diagnostic log forwarding doesn't automatically collect application traces or Azure metrics. For Azure metrics, configure the Azure Metrics integration.
Manage security coverage and investigations
Use the overview entry points to connect security data and investigate it:
| Entry point | Security task |
|---|---|
| Ingest logs and metrics from Azure Services | Collect activity and resource logs for security auditing and investigations |
| Add more data sources in Elastic | Configure endpoint, cloud security, and threat intelligence integrations |
| View and manage your data in Elastic | Open Elastic Security to review detections, investigate alerts, and explore security events |
Maintain security data coverage
- Review Monitored resources and Monitored Subscriptions against the Azure environments in your security scope.
- Check log forwarding rules when you add or retag resources. Include and exclude rules control collection, not threat detection.
- Configure additional integrations and endpoint policies in Elastic for the sources your detections require. Installing an agent alone isn't the same as configuring endpoint protection.
- Review detection rules and investigate alerts in Elastic Security. Confirm that each rule has the required data sources before relying on its results.
Azure integration settings
The following settings manage the Azure integration rather than your indexes, embeddings, dashboards, or detection rules. For Search and Vector Database workloads, platform log collection and virtual machine agents are optional and separate from document ingestion.
Reconfigure rules for logs and metrics
To change which Azure resources send logs to Elastic:
- Select Elastic deployment configuration > Logs & metrics in the service menu.
- Update the tag-based include/exclude rules or toggle individual settings. See tag rules for sending metrics and tag rules for sending logs for worked examples.
- Changes take effect within a few minutes as diagnostic settings are updated on matching resources.
For a full reference on what data is forwarded and how tag rules behave, see Monitor & Observe Azure resources with Azure Native Integrations.
View monitored resources
To view the list of resources emitting logs to Elastic, select Elastic deployment configuration > Monitored resources in the service menu.
Tip
You can filter the list of resources by type, subscription, resource group, region, and whether the resource is sending logs to Elastic.
If a resource you expect to see isn't sending data, check:
- The resource type supports Azure Monitor diagnostic logs. See supported categories.
- Your tag rules include (not exclude) the resource.
- The resource hasn't reached the limit of five diagnostic settings.
Monitor multiple subscriptions
A single Elastic resource can monitor Azure resources across multiple subscriptions. This is useful when you have separate subscriptions for dev, staging, and production but want unified monitoring in Elastic.
Prerequisites
You must have both of the following Azure permissions:
Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/delete
The resource provider for Elastic (
Microsoft.Elastic) must be registered in the target subscription.
Add subscriptions
Important
When you link a subscription to an Elastic resource, ensure that the subscription isn't scope locked (read-only or delete locks). Scope locks can prevent the addition and removal of diagnostic settings. For more information, see Lock your Azure resources.
To monitor multiple subscriptions:
Select Elastic deployment configuration > Monitored Subscriptions.
Select Add subscriptions from the Command bar.
The Add Subscriptions experience shows subscriptions you have Owner role assigned to and any Elastic resource created in those subscriptions that is already linked to the same Elastic organization as the current resource.
Select the subscriptions you want to monitor and select Add.
Important
Setting separate tag rules for different subscriptions isn't supported. The tag rules from the primary resource apply to all monitored subscriptions.
Diagnostic settings are automatically added to the subscription's resources that match the defined tag rules.
Select Refresh to view the subscriptions and their monitoring status.
Once the subscription is added, the status changes to Active.
Remove subscriptions
Important
When you unlink a subscription from an Elastic resource, ensure that the subscription isn't scope locked (read-only or delete locks). Scope locks can prevent the addition and removal of diagnostic settings. For more information, see Lock your Azure resources.
To unlink subscriptions from an Elastic resource:
Select Elastic deployment configuration > Monitored Subscriptions from the service menu.
Select the subscription you want to remove.
Choose Remove subscriptions.
To view the updated list of monitored subscriptions, select Refresh from the Command bar.
Elastic Agent deployment
You can install Elastic Agents on Azure virtual machines to collect host-level metrics, logs, and security events that aren't available through Azure diagnostic logs alone.
- Select Elastic deployment configuration > Virtual machines in the service menu.
Install an agent
To install an agent:
Choose the resource you would like to monitor.
Select Install Extension.
Select OK.
After the agent is installed, the status changes to Installed. The service restarts once installation is complete.
Uninstall an agent
To uninstall an agent:
Choose a resource.
Select Uninstall Extension.
Select OK.
Tip
Elastic Agents collect detailed process-level metrics, file integrity monitoring data, and custom application logs. This data complements the Azure platform logs configured in the Logs & metrics section.
Azure OpenAI integration
Connect an Azure OpenAI text or chat completion deployment for use by Elastic's AI Assistant. This connector is separate from document ingestion and embedding generation; creating it doesn't configure a semantic search index.
To configure Azure OpenAI:
Select Elastic deployment configuration > Azure OpenAI configuration.
From the working pane's command bar, select Add.
In the Add OpenAI Configuration panel, select your preferred Azure OpenAI Resource and Azure OpenAI Deployment.
Select the Create button.
After the connector is created, navigate to Kibana to use it.
Note
Kibana is a user interface that lets you visualize your Elasticsearch data and navigate the Elastic Stack. Your connector can be used in Elastic's AI Assistant, which provides contextual responses to your natural language prompts by invoking the Azure OpenAI deployment.
The deployment details (URL and API keys) are passed to Elastic to prepare the connector for use with Elastic's AI Assistant.
Currently, Elastic resources support only deployments of text or chat completion models, like GPT-4. For more information, see OpenAI connector and action.
Traffic filters
Restrict network access to your Elastic deployment using IP address filtering or Azure Private Link. Traffic filters are defined as rulesets that you create once and then associate with one or more deployments. Each ruleset is region-scoped and must be in the same region as the deployments it protects; a deployment can have multiple rulesets attached, and once any ruleset is associated, all unmatched traffic is denied.
- IP filtering uses an allow list of individual IPv4 addresses or CIDR blocks. It's the simplest option for restricting public endpoint access from known networks (corporate egress, NAT gateways, jump boxes). Rules are evaluated against the source IP of incoming requests to the Elasticsearch and Kibana endpoints.
- Azure Private Link routes traffic to your deployment over the Microsoft backbone without traversing the public internet. You create an Azure Private Endpoint in your virtual network that targets the regional Elastic Cloud Private Link service alias, then register the endpoint's resource GUID and name as a Private Link ruleset and associate it with the deployment. The deployment becomes reachable only through that endpoint.
To create a ruleset from the Azure-integrated Elastic experience: in the left menu select Elastic deployment configuration > Traffic Filter, enter a name, pick IP Address and CIDR Blocks or Private Link, fill in the rules or endpoint details, and select Create. If a traffic filter is no longer needed, unlink it from the deployment first, then delete the ruleset.
Important
The traffic filter must be in the same region as the deployment.
Learn more
- Configure IP traffic filters (Elastic Cloud)
- Private connectivity to Elastic Cloud on Azure
- What is Azure Private Link?
Connected Elastic resources
To view all Elastic resources and deployments you created (from both Azure and Elastic portals), go to the Connected Elastic Resources tab in any of your Azure Elastic resources.
You can manage the corresponding Elastic deployments or Azure resources using the links, provided you have Owner or Contributor rights to those deployments and resources.
Delete Elastic resource
To delete a resource:
On the command bar, select Delete.
On the Delete Resource pane, optionally select a reason for deleting the resource.
In the Enter resource name to confirm deletion box, enter the name of the resource.
Select Delete.
Select Delete again to confirm deletion.
After the resource is deleted, all billing for that resource through Azure Marketplace stops.
Important
- A single Azure Marketplace SaaS subscription unifies billing for multiple Elastic deployments.
- If you wish to completely stop billing for the Marketplace SaaS, delete all linked Elastic deployments created from the Azure portal or Elastic portal.
Get support
Contact Elastic for customer support. If your Elastic Cloud resource is not fully set up and you're not able to access the Support page, send an email to support@elastic.co.
You can also request support in the Azure portal from the resource overview. Select Support + Troubleshooting > New support request from the service menu.
