docs/reference/connectors-kibana/pre-configured-connectors.md
If you are running {{kib}} on-prem, you can preconfigure a connector to have all the information it needs prior to startup by adding it to the kibana.yml file.
::::{note} {{ech}} provides a preconfigured email connector but you cannot create additional preconfigured connectors. ::::
Preconfigured connectors offer the following benefits:
Add xpack.actions.preconfigured settings to your kibana.yml file. The settings vary depending on which type of connector you’re adding. Refer to Preconfigured connector settings.
This example shows a valid configuration for a Slack connector and a Webhook connector:
xpack.actions.preconfigured:
my-slack1: <1>
actionTypeId: .slack <2>
name: 'Slack #xyz' <3>
secrets:
webhookUrl: 'https://hooks.slack.com/services/abcd/efgh/ijklmnopqrstuvwxyz'
webhook-service:
actionTypeId: .webhook
name: 'Email service'
config: <4>
url: 'https://email-alert-service.elastic.co'
method: post
headers:
header1: value1
header2: value2
secrets: <5>
user: elastic
password: changeme
exposeConfig: true <6>
my-slack1 in this example.actionTypeId is the action type identifier.name is the name of the preconfigured connector.config is the configuration specific to the connector type.secrets is the sensitive configuration, such as username, password, and keys, specific to the connector type.exposeConfig is the optional boolean flag, which identify if connector config will be exposed in the actions API::::{note} Sensitive properties, such as passwords, can also be stored in the {{kib}} keystore.
::::
go to the {{connectors-ui}} page using the navigation menu or the global search field. Preconfigured connectors appear regardless of which space you are in. They are tagged as “preconfigured”, and you cannot delete them.
% TO DO: Use :class: screenshot
Clicking a preconfigured connector shows the description, but not the configuration.
{{kib}} provides the following built-in preconfigured connectors:
::::{warning} This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. ::::
{{kib}} offers a preconfigured index connector to facilitate indexing active alert data into {{es}}. To use this connector, set xpack.actions.preconfiguredAlertHistoryEsIndex to true.
When you subsequently create rules, you can use the Alert history Elasticsearch index (preconfigured) connector.
% TO DO: Use :class: screenshot
Documents are indexed using a preconfigured schema that captures the action variables available for the rule. By default, these documents are indexed into the kibana-alert-history-default index, but you can specify a different index. Index names must start with kibana-alert-history- to take advantage of the preconfigured alert history index template.
::::{important}
all or write privileges to the kibana-alert-history-* indices.kibana-alert-history-* indices are not configured to use ILM so they must be maintained manually. If the index size grows large, consider using the delete by query API to clean up older documents in the index.::::
The following example creates an {{bedrock}} connector:
xpack.actions.preconfigured:
my-bedrock:
name: preconfigured-bedrock-connector-type
actionTypeId: .bedrock
config:
apiUrl: https://bedrock-runtime.us-east-1.amazonaws.com <1>
defaultModel: us.anthropic.claude-sonnet-4-5-20250929-v1:0 <2>
secrets:
accessKey: key-value <3>
secret: secret-value <4>
The following example creates a D3 Security connector:
xpack.actions.preconfigured:
my-d3security:
name: preconfigured-d3security-connector-type
actionTypeId: .d3security
config:
url: <example-url>/elasticsearch/VSOC/api/Data/Kibana/Security%20Operations/CreateEvents <1>
secrets:
token: superlongtoken <2>
The following example creates an email connector:
xpack.actions.preconfigured:
my-email:
name: preconfigured-email-connector-type
actionTypeId: .email
config:
service: other <1>
from: [email protected] <2>
host: validhostname <3>
port: 8080 <4>
secure: false <5>
hasAuth: true <6>
secrets:
user: testuser <7>
password: passwordkeystorevalue <8>
service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer’s well-known email service providers, the host, port, and secure properties are ignored. If service is other, the host and port properties must be defined. For more information on the gmail service value, refer to Nodemailer Gmail documentation. If service is exchange_server, the tenantId, clientId, clientSecret properties are required instead of host and port.user@host-name format.true, this connector will require values for user and password inside the secrets configuration. Defaults to true.hasAuth is set to true.hasAuth is set to true.Use the following email connector configuration to send email from the Amazon Simple Email Service (SES) SMTP service:
config:
service: ses
// `host`, `port` and `secure` have the following default values and do not need to set:
// host: email-smtp.us-east-1.amazonaws.com <1>
// port: 465
// secure: true
secrets:
user: <username>
password: <password>
config.host varies depending on the regionUse the following email connector configuration to send email from the Gmail SMTP service:
config:
service: gmail
// `host`, `port` and `secure` have the following default values and do not need to set:
// host: smtp.gmail.com
// port: 465
// secure: true
secrets:
user: <username>
password: <password>
:::{admonition} Deprecated in 7.16.0 Microsoft Exchange with basic authentication was deprecated in 7.16.0. :::
config:
service: other
host: <your exchange server>
port: 465
secure: true
from: <email address of service account> <1>
secrets:
user: <email address of service account> <2>
password: <password>
from field is a valid local email account.Use the following email connector configuration to send email from Microsoft Exchange:
config:
service: exchange_server
clientId: <The Application (client) ID> <1>
tenantId: <The directory tenant ID, in GUID format.>
from: <email address of service account> <2>
secrets:
clientSecret: <URL-encoded string>
from field is a valid local email account.Use the following email connector configuration to send email from the Outlook.com SMTP service:
config:
service: outlook365
// `host`, `port` and `secure` have the following default values and do not need to set:
// host: smtp.office365.com
// port: 587
// secure: false
secrets:
user: <email.address>
password: <password>
The following example creates a OpenAI connector:
xpack.actions.preconfigured:
my-open-ai:
name: preconfigured-openai-connector-type
actionTypeId: .gen-ai
config:
apiUrl: https://api.openai.com/v1/chat/completions <1>
apiProvider: 'OpenAI' <2>
defaultModel: gpt-4.1 <3>
secrets:
apiKey: superlongapikey <4>
OpenAI or Azure OpenAI.apiProvider is OpenAI.The following example creates a {{ibm-r}} connector:
xpack.actions.preconfigured:
my-resilient:
name: preconfigured-resilient-connector-type
actionTypeId: .resilient
config:
apiUrl: https://elastic.resilient.net <1>
orgId: ES <2>
secrets:
apiKeyId: testuser <3>
apiKeySecret: tokenkeystorevalue <4>
The {{ibm-r}} instance URL.
The {{ibm-r}} organization identifier.
The authentication key ID for HTTP basic authentication.
The authentication key secret for HTTP basic authentication.
:::{note} This value should be stored in the {{kib}} keystore. :::
The following example creates a index connector:
xpack.actions.preconfigured:
my-index:
name: preconfigured-index-connector-type
actionTypeId: .index
config:
index: .kibana <1>
executionTimeField: my-field <2>
The following example creates a Jira connector:
xpack.actions.preconfigured:
my-jira:
name: preconfigured-jira-connector-type
actionTypeId: .jira
config:
apiUrl: https://elastic.atlassian.net <1>
projectKey: ES <2>
secrets:
email: testuser <3>
apiToken: tokenkeystorevalue <4>
The Jira instance URL.
The Jira project key.
The account email for HTTP basic authentication.
The API authentication token for HTTP basic authentication.
:::{note} This value should be stored in the {{kib}} keystore. :::
The following example creates a Microsoft Teams connector:
xpack.actions.preconfigured:
my-teams:
name: preconfigured-teams-connector-type
actionTypeId: .teams
secrets:
webhookUrl: 'https://outlook.office.com/webhook/abcd@0123456/IncomingWebhook/abcdefgh/ijklmnopqrstuvwxyz' <1>
The following example creates an {{opsgenie}} connector:
xpack.actions.preconfigured:
my-opsgenie:
name: preconfigured-opsgenie-connector-type
actionTypeId: .opsgenie
config:
apiUrl: https://api.opsgenie.com <1>
secrets:
apiKey: apikey <2>
The following example creates a PagerDuty connector:
xpack.actions.preconfigured:
my-pagerduty:
name: preconfigured-pagerduty-connector-type
actionTypeId: .pagerduty
config:
apiUrl: <EXAMPLE_URL> <1>
secrets:
routingKey: testroutingkey <2>
The following example creates a server log connector:
xpack.actions.preconfigured:
my-server-log:
name: preconfigured-server-log-connector-type
actionTypeId: .server-log
The following example creates a {{sn-itom}} connector with basic authentication:
xpack.actions.preconfigured:
my-servicenow-itom:
name: preconfigured-servicenow-connector-type
actionTypeId: .servicenow-itom
config:
apiUrl: <SERVICENOW_INSTANCE_URL> <1>
secrets:
username: testuser <2>
password: passwordkeystorevalue <3>
The ServiceNow instance URL.
A user name.
A password.
:::{note} This value should be stored in the {{kib}} keystore. :::
The following example creates a {{sn-itom}} connector with OAuth authentication:
xpack.actions.preconfigured:
my-servicenow:
name: preconfigured-oauth-servicenow-connector-type
actionTypeId: .servicenow-itom
config:
apiUrl: <SERVICENOW_INSTANCE_URL>
isOAuth: true <1>
userIdentifierValue: [email protected] <2>
clientId: abcdefghijklmnopqrstuvwxyzabcdef <3>
jwtKeyId: fedcbazyxwvutsrqponmlkjihgfedcba <4>
secrets:
clientSecret: secretsecret <5>
privateKey: | <6>
-----BEGIN RSA PRIVATE KEY-----
MIIE...
KAgD...
... multiple lines of key data ...
-----END RSA PRIVATE KEY-----
privateKeyPassword.The following example creates a {{sn-itsm}} connector with basic authentication:
xpack.actions.preconfigured:
my-servicenow:
name: preconfigured-servicenow-connector-type
actionTypeId: .servicenow
config:
apiUrl: <SERVICENOW_INSTANCE_URL> <1>
usesTableApi: false <2>
secrets:
username: testuser <3>
password: passwordkeystorevalue <4>
The ServiceNow instance URL.
Specifies whether the connector uses the Table API or the Import Set API. If usesTableApi is false, the Elastic application should be installed in {{sn}}.
The user name.
The password.
:::{note} This value should be stored in the {{kib}} keystore. :::
The following example creates a {{sn-itsm}} connector with OAuth authentication:
xpack.actions.preconfigured:
my-servicenow:
name: preconfigured-oauth-servicenow-connector-type
actionTypeId: .servicenow
config:
apiUrl: <SERVICENOW_INSTANCE_URL>
usesTableApi: false
isOAuth: true <1>
userIdentifierValue: [email protected] <2>
clientId: abcdefghijklmnopqrstuvwxyzabcdef <3>
jwtKeyId: fedcbazyxwvutsrqponmlkjihgfedcba <4>
secrets:
clientSecret: secretsecret <5>
privateKey: | <6>
-----BEGIN RSA PRIVATE KEY-----
MIIE...
KAgD...
... multiple lines of key data ...
-----END RSA PRIVATE KEY-----
privateKeyPassword.The following example creates a {{sn-sir}} connector with basic authentication:
xpack.actions.preconfigured:
my-servicenow-sir:
name: preconfigured-servicenow-connector-type
actionTypeId: .servicenow-sir
config:
apiUrl: <SERVICENOW_INSTANCE_URL> <1>
usesTableApi: false <2>
secrets:
username: testuser <3>
password: passwordkeystorevalue <4>
The ServiceNow instance URL.
Specifies whether the connector uses the Table API or the Import Set API. If usesTableApi is false, the Elastic application should be installed in {{sn}}.
The user name.
The password.
:::{note} This value should be stored in the {{kib}} keystore. :::
The following example creates a {{sn-sir}} connector with OAuth authentication:
xpack.actions.preconfigured:
my-servicenow:
name: preconfigured-oauth-servicenow-connector-type
actionTypeId: .servicenow-sir
config:
apiUrl: <SERVICENOW_INSTANCE_URL>
usesTableApi: false
isOAuth: true <1>
userIdentifierValue: [email protected] <2>
clientId: abcdefghijklmnopqrstuvwxyzabcdef <3>
jwtKeyId: fedcbazyxwvutsrqponmlkjihgfedcba <4>
secrets:
clientSecret: secretsecret <5>
privateKey: | <6>
-----BEGIN RSA PRIVATE KEY-----
MIIE...
KAgD...
... multiple lines of key data ...
-----END RSA PRIVATE KEY-----
privateKeyPassword.The following example creates a Slack connector with webhook:
xpack.actions.preconfigured:
my-slack:
name: preconfigured-slack-webhook-connector-type
actionTypeId: .slack
secrets:
webhookUrl: 'https://hooks.slack.com/services/xxxx/xxxx/xxxx' <1>
The following example creates a Slack connector with web API:
xpack.actions.preconfigured:
my-slack:
name: preconfigured-slack-api-connector-type
actionTypeId: .slack_api
secrets:
token: 'xoxb-xxxx-xxxx-xxxx' <1>
The following example creates a Swimlane connector:
xpack.actions.preconfigured:
my-swimlane:
name: preconfigured-swimlane-connector-type
actionTypeId: .swimlane
config:
apiUrl: <SWIMLANE_INSTANCE_URL> <1>
appId: app-id <2>
mappings: <3>
alertIdConfig:
fieldType: text
id: agp4s
key: alert-id
name: Alert ID
caseIdConfig:
fieldType: text
id: ae1mi
key: case-id
name: Case ID
caseNameConfig:
fieldType: text
id: anxnr
key: case-name
name: Case Name
commentsConfig:
fieldType: comments
id: au18d
key: comments
name: Comments
descriptionConfig:
fieldType: text
id: ae1gd
key: description
name: Description
ruleNameConfig:
fieldType: text
id: avfsl
key: rule-name
name: Rule Name
severityConfig:
fieldType: text
id: a71ik
key: severity
name: severity
secrets:
apiToken: tokenkeystorevalue <4>
The {{swimlane}} instance URL.
The {{swimlane}} application identifier.
Field mappings for properties such as the alert identifer, severity, and rule name.
The API authentication token for HTTP basic authentication.
:::{note} This value should be stored in the {{kib}} keystore. :::
The following example creates a Tines connector:
xpack.actions.preconfigured:
my-tines:
name: preconfigured-tines-connector-type
actionTypeId: .tines
config:
url: <TINES_TENANT_URL> <1>
secrets:
email: [email protected] <2>
token: ausergeneratedapitoken <3>
The following example creates a Torq connector:
xpack.actions.preconfigured:
my-torq:
name: preconfigured-torq-connector-type
actionTypeId: .torq
config:
webhookIntegrationUrl: <TORQ_ENDPOINT_URL>/v1/somehook <1>
secrets:
token: mytorqtoken <2>
The following example creates a webhook connector with basic authentication:
xpack.actions.preconfigured:
my-webhook:
name: preconfigured-webhook-connector-type
actionTypeId: .webhook
config:
url: <EXAMPLE_URL> <1>
method: post <2>
headers: <3>
testheader: testvalue
hasAuth: true <4>
secrets:
user: testuser <5>
password: passwordkeystorevalue <6>
The web service request URL. If you are using the xpack.actions.allowedHosts setting, make sure the hostname is added to the allowed hosts.
The HTTP request method, either post(default) or put.
A set of key-value pairs sent as headers with the request.
If true, this connector will require values for user and password inside the secrets configuration. Defaults to true.
A valid user name. Required if hasAuth is set to true.
A valid password. Required if hasAuth is set to true.
:::{note} This value should be stored in the {{kib}} keystore. :::
::::{note} SSL authentication is not supported in preconfigured webhook connectors. ::::
The following example creates a {{webhook-cm}} connector:
xpack.actions.preconfigured:
my-case-management-webhook:
name: Case Management Webhook Connector
actionTypeId: .cases-webhook
config:
hasAuth: true <1>
headers: <2>
'content-type': 'application/json'
createIncidentUrl: '<EXAMPLE_URL>/rest/api/2/issue' <3>
createIncidentMethod: 'post' <4>
createIncidentJson: '{"fields":{"summary":{{{case.title}}},"description":{{{case.description}}},"labels":{{{case.tags}}}' <5>
getIncidentUrl: '<EXAMPLE_URL>/rest/api/2/issue/{{{external.system.id}}}' <6>
getIncidentResponseExternalTitleKey: 'key' <7>
viewIncidentUrl: '<EXAMPLE_URL>/browse/{{{external.system.title}}}' <8>
updateIncidentUrl: '<EXAMPLE_URL>/rest/api/2/issue/{{{external.system.id}}}' <9>
updateIncidentMethod: 'put' <10>
updateIncidentJson: '{"fields":{"summary":{{{case.title}}},"description":{{{case.description}}},"labels":{{{case.tags}}}' <11>
createCommentMethod: 'post', <12>
createCommentUrl: '<EXAMPLE_URL>/rest/api/2/issue/{{{external.system.id}}}/comment', <13>
createCommentJson: '{"body": {{{case.comment}}}}', <14>
secrets:
user: testuser <15>
password: passwordvalue <16>
true, this connector will require values for user and password inside the secrets configuration.hasAuth is true.hasAuth is true.The following example creates an xMatters connector with basic authentication:
xpack.actions.preconfigured:
my-xmatters:
name: preconfigured-xmatters-connector-type
actionTypeId: .xmatters
config:
configUrl: <EXAMPLE_REQUEST_URL> <1>
usesBasic: true <2>
secrets:
user: testuser <3>
password: passwordkeystorevalue <4>
The request URL for the Elastic Alerts trigger in xMatters.
Indicates whether the connector uses HTTP basic authentication. If true, you must provide user and password values. Defaults to true.
A user name for authentication, which is required when usesBasic is true.
A password for authentication, which is required when usesBasic is true.
:::{note} This value should be stored in the {{kib}} keystore. :::
The following example creates an xMatters connector with URL authentication:
xpack.actions.preconfigured:
my-xmatters:
name: preconfigured-xmatters-connector-type
actionTypeId: .xmatters
config:
usesBasic: false <1>
secrets:
secretsUrl: <EXAMPLE_HOST_URL>?apiKey=1234-abcd <2>
false to use URL authentication. Defaults to true.