Customer Architect

Connecting a self-managed Elasticsearch cluster with AutoOps. * Written By: Team Qavi Tech * Published: April 3, 2026 * Read Time: 11-15 Min Table of contents. Introduction. Managing Elasticsearch clusters can be complex at times. As clusters grow, teams often spend significant time troubleshooting performance issues and monitoring cluster health. Elastic introduced AutoOps to simplify these operational challenges. AutoOps automatically analyzes cluster metrics and provides actionable recommendations, reducing the need for manual intervention AutoOps in Elastic. AutoOps is an operational monitoring and diagnostic feature that helps you understand what is happening inside your Elasticsearch cluster. AutoOps evaluates cluster metrics and provides insights in several key areas like: Root cause analysis: Instead of only showing metrics, AutoOps identifies the actual cause of a problem. This saves engineers from manually correlating multiple metrics and logs. Performance recommendations: AutoOps provides clear suggestions for resolving issues, such as: * Fixing shard imbalances * Optimizing mappings * Improving indexing pipelines * Adjusting cluster settings These recommendations are practical and easy to implement. Configuration issues: Flags settings that may affect performance Reduced Operational Overhead: Because analysis is handled in Elastic Cloud, AutoOps eliminates the need for additional monitoring infrastructure. Engineers can focus on resolving issues instead of building dashboards or maintaining monitoring tools. Resource utilization problems: Highlights bottlenecks in memory, CPU and disk usage. This helps teams detect issues proactively before they impact cluster performance or availability. How to setup AutoOps in your self managed environment. Here's how you connect a self-managed Elasticsearch cluster to Elastic AutoOps quickly. The following section provides details on how to set up Elastic AutoOps in your local environment: First, go to Elastic Cloud and log in to your account. If you don't have one, you can create it for free at cloud.elastic.co. * Once logged in, go to the cloud management page * Navigate to Connected Clusters. * Notice that it says "Just want AutoOps?" click on "Get started" 2. Choose how to run the agent. Decide where you want to run the connection agent. You can choose from Kubernetes, Elastic Cloud on Kubernetes (ECK), Docker, or Linux. I have a windows system, so I chose Docker. 3. Enter your cluster's URL. In the setup wizard, type the web address (URL) of your self-managed Elasticsearch cluster, I chose http://host.docker.internal:9200 since I chose Docker for deployment of the AutoOps agent, you can add the URL of your deployment (Kubernetes, Elastic Cloud on Kubernetes (ECK), Docker, or Linux) and choose the authentication method, whether you want to use your self managed cluster's API or username and password. I chose API key for authentication, keep in mind to add it to the compose.yaml 4. Run the install command. The wizard gives you a simple install command. Copy and run it where your cluster can reach it. This installs a lightweight agent that sends metrics (not data) to AutoOps. 5. Create the Docker compose file. Copy the command from the wizard to a file, and save that file where you have saved your ELK cluster. Add your self managed Elasticsearch API key in AUTOOPS_ES_API_KEY After these steps, click on "I have run the command" And it will wait for metrics to be collected and your cluster will be connected. AutoOps will start showing insights in a few minutes. NOTE: No events are visible since this is a fresh cluster An Elastic Stack with daily alerts and automated reporting provides not only a more elaborate and visually intuitive dashboard, but also enables a deeper and more comprehensive root cause analysis. By consistently aggregating and analyzing data, it allows teams to identify patterns, detect anomalies, and correlate events across multiple sources with greater accuracy. This level of observability ensures faster troubleshooting, improved decision-making, and a clearer understanding of system behavior over time, as illustrated in the example shown below. Conclusion. Connecting your self-managed Elasticsearch cluster to AutoOps gives users clear visibility into cluster performance without the need to manually analyze logs or metrics. It automatically monitors health, resource usage, query performance, and shard distribution, while providing recommendations to fix issues quickly. For Elastic users, this means faster troubleshooting and less time spent guessing what's wrong. By relying on AutoOps, teams can focus more on building applications and less on maintaining infrastructure, making Elasticsearch cluster management simpler and more efficient for everyone. Team Qavi Tech More blogs. Discover the latest insights and trends in technology with the Qavi Tech Blog. Stay updated with expert articles, industry news, and innovative ideas.

Elastic has fallen 43.2% over the past six months to trade at $49.79 per share, prompting questions about whether the stock presents a buying opportunity. However, several metrics suggest caution. The company's billings grew at an average of 12.5% year-on-year over the last four quarters, indicating challenges in customer acquisition and retention. Wall Street analysts project revenue growth of 13.6% over the next 12 months, a deceleration from its 24.8% annualised growth over the past five years. On a positive note, Elastic's operating margin improved by 4.5 percentage points over the last two years, though it remains negative at -1.7% for the trailing 12 months. The stock currently trades at 2.8× forward price-to-sales. Despite the reasonable valuation, analysts suggest better opportunities exist elsewhere.

Sub-second search and smarter scale: why modern SIEM is being rebuilt from scratch. Security information and event management has become essential for enterprises trying to avoid a costly data swamp while preserving visibility across massive environments. Clearly, modernizing SIEM is now less a technical upgrade than a business imperative. The pressure clearly is on to turn sprawling telemetry into actionable intelligence, without breaking the budget. The key to this evolution is building a robust foundation before addressing the analytics layer, according to Sal Picheria (pictured, right), corporate vice president of security engineering at New York Life Insurance Co. By focusing on a high-performance data engine first, teams can ensure their security tooling remains in line with natural data growth. "When we thought about our data journey at New York Life, we actually thought, 'How can we find the most capable data platform to house our security data' before we started thinking about the SIEM problem," Picheria said. "We eventually landed on Elastic, mainly because it just wound up being a rock-solid, generic data engine for use in security. As we went down that road further, we wound up uncovering that Elastic actually has a great SIEM functionality as well. It made a lot of sense to approach it in that way. I like to describe this concept internally as we build the pyramid from the bottom up." Picheria and Mike Nichols (left), general manager of security at Elastic, spoke with Dave Vellante at the RSAC 2026 Conference, during an exclusive broadcast on theCUBE, SiliconANGLE Media's livestreaming studio. They discussed modernizing SIEM, the concept of the cyber data lake and how hybrid search is replacing the "love-hate" relationship practitioners often have with legacy platforms. (* Disclosure below.) Scaling visibility by modernizing SIEM. By working with Elastic, New York Life is aiming to scale visibility across growing volumes of security data without letting costs spiral out of control. That matters because, in an agentic AI era, visibility is becoming the foundation of effective defense. By modernizing SIEM architectures to support sub-second query times, organizations are in a better position to retain, search and act on more of their security data - an advantage that becomes critical as threats accelerate, Nichols noted. "Security doesn't work without visibility," Nichols said. "If we are predatory in how we make you choose what data to keep and what data to drop... when that data increases, if you can't afford what you have today and you can't search what you have today, there's no way you can focus on tomorrow." By combining classic search with vectorized search, enterprises can tailor their response to specific risks instead of forcing every problem through the same lens. Just as important, that kind of flexibility can give organizations confidence that they are working with a partner capable of adapting alongside a fast-changing threat landscape, Nichols explained. "The adversarial usage of AI has caused rampant challenges. The zero days. Microsoft Patch Tuesday - every single Patch Tuesday is record-breaking. We see the cost of exploits going down," Nichols said. "That has really been the compelling event to [ask], 'Am I partnering with somebody who's going to lead forward to the future?'" Here's the complete video interview, part of SiliconANGLE's and theCUBE's coverage of the RSAC 2026 Conference: (* Disclosure: Elastic sponsored this segment of theCUBE. Neither Elastic nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.) Photo: SiliconANGLE. A message from John Furrier, co-founder of SiliconANGLE: Support its mission to keep content open and free by engaging with theCUBE community. Join theCUBE's Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. * 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more * 11.4k+ theCUBE alumni - Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. About SiliconANGLE Media SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios - with flagship locations in Silicon Valley and the New York Stock Exchange - SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Its new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.