Elasticsearch exporter

Elasticsearch receives traces, metrics, and logs from the Alokai collector via its native OTLP endpoint. Traces appear in APM → Services; metrics and logs are queryable in Discover and can be used in dashboards and alerting.

What you need

OTLP endpoint — depends on how your Elastic deployment is hosted:

Deployment	Endpoint
Elastic Cloud Serverless	Managed OTLP endpoint, from the Elastic Cloud console
Elastic Cloud Hosted (9.0+)	Managed OTLP endpoint, from the Elastic Cloud console
Self-managed Elasticsearch (9.2+)	`https://<your-elasticsearch-host>:9200/_otlp`

API key — see Creating an API key below.

For self-managed Elasticsearch, the endpoint must include the /_otlp path. The collector appends the per-signal path itself (/v1/traces, /v1/metrics, /v1/logs), so an endpoint without /_otlp results in 404 responses and no data.

Elasticsearch accepts OTLP over HTTP only — there is no gRPC endpoint. The Alokai collector always uses OTLP/HTTP for this integration, so no protocol configuration is required.

Creating an API key

In Kibana, go to Stack Management → Security → API keys.
Click Create API key.
Enter a name — e.g. alokai-cloud-otel.

Enable Control security privileges and add the role descriptor matching your endpoint:

Managed OTLP endpoint (Elastic Cloud):

{
  "otlp_writer": {
    "applications": [
      {
        "application": "apm",
        "resources": ["*"],
        "privileges": ["event:write"]
      }
    ]
  }
}

Self-managed Elasticsearch:

{
  "otlp_writer": {
    "indices": [
      {
        "names": ["traces-*", "metrics-*", "logs-*"],
        "privileges": ["create_doc", "auto_configure"]
      }
    ]
  }
}

Include only the data stream patterns for the signals you intend to export.

Click Create API key.
Copy the Encoded value of the key.

You must use the Encoded value, not the raw id and api_key pair. Kibana offers several formats when the key is created — the Alokai collector sends the key as an ApiKey authorization header, which requires the encoded form. Pasting the raw key results in 401 responses.

Configuring in the Console

In the Console, navigate to your instance's observability settings and enable the Elasticsearch integration. You will be asked to provide:

OTLP endpoint
API key
Which signals to enable: Traces, Metrics, Logs, or any combination

The collector is deployed automatically once you save.

Signal availability

Support depends on your Elastic version and deployment type:

Signal	Managed OTLP endpoint	Self-managed Elasticsearch
Traces	Generally available	Technical preview (9.5+)
Metrics	Generally available	Generally available (9.2+)
Logs	Generally available	Technical preview (9.5+)

The Managed OTLP endpoint requires Elastic Cloud Serverless, or Elastic Cloud Hosted on version 9.0 or later.

Finding your data in Elasticsearch

Traces appear in APM → Services if service.name is set on your application. Open a service and use Transactions and Trace explorer to inspect individual traces and their spans. The underlying documents are indexed into traces-* data streams.

Metrics are indexed into metrics-* data streams. Custom metrics emitted by your application keep their original OTel metric names and can be charted in Discover, Lens, and dashboards.

Logs are indexed into logs-* data streams and are searchable in Discover. Application logs collected from your instance arrive alongside any logs your application exports through the OTel SDK.

Service naming

Elasticsearch uses the service.name OTel resource attribute to create and group APM service entities. Set it via environment variables on your application:

OTEL_SERVICE_NAME=storefront
OTEL_RESOURCE_ATTRIBUTES=deployment.environment=production,service.version=1.4.2

Without service.name, traces are attributed to a generic unknown_service entry, making them difficult to locate in the APM UI.