> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Elasticsearch On-Prem

<Info>
  **Prerequisite**: The [Resolve Satellite](/resolve-satellite) should be installed in your environment.
</Info>

## Create a Service Account Token

To access your Elasticsearch environment a service account token is needed. If you don’t already have a service account, please create one: [How to create a service account](https://www.elastic.co/guide/en/elasticsearch/reference/current/service-accounts.html).

Once you have a Service Account to use, you can create an API Key with **read-only** permissions.

<Accordion title="Option 1: Create the API Key via the UI [Recommended]">
  1. In the Elastic UI, open **Stack Management > API Keys**
  2. Click on **Create API Key**
  3. Enter a **Name** for your key, ex. `resolve-api-access`
  4. In the **Control security privileges** section, add this block for permissions:
</Accordion>

```json Permissions theme={null}
{
  "resolveai-role": {
    "cluster": [
      "cluster:monitor/main",
      "cluster:monitor/stats",
      "cluster:monitor/state"
    ],
    "indices": [
      {
        "names": ["*"],
        "privileges": ["read", "view_index_metadata", "monitor"]
      }
    ]
  }
}
```

<Accordion title="Option 2: Create the API Key via  the REST API">
  Official Documentation: [Access and Authentication](https://www.elastic.co/guide/en/cloud/current/ec-api-authentication.html)

  Run the following command. Please ensure that you replace the following properties:

  * **ELASTIC\_PASSWORD:** This is the password of the *elastic* user.
  * **ELASTIC\_HOSTNAME:** This is the FQDN of the Elastic endpoint.

  ```shell theme={null}
  curl -k -X PUT --user [elastic:ELASTIC_PASSWORD] \
  --header "Content-Type: application/json" https://[ELASTIC_HOSTNAME]:9200/_security/api_key 
  -d '{"name":"resolve-ai-api-access"}
  ```

  The response will include the **encoded token**. Please copy it.

  ```json Response theme={null}
  {
      "id":"********",
      "name":"resolve-ai-api-access",
      "api_key":"********",
      "encoded":"SkpDbUJaVXXXXXXXXXXXX***************" // This is your token
    }
  ```
</Accordion>

<Info>
  **Note**: You must copy the encoded token. You will not be able to retrieve it after creation. Store this token in a secure manner, and do not check into source code. This token will be used in your ResolveAI configuration.
</Info>

## Configure the Elasticsearch integration in Resolve Satellite

Below is an example of how to setup the Elasticsearch integration in the satellite with the url property as well as using the k8s secret (potentially backed by an AWS secret manager or another mechanism) for authentication.

<Steps>
  <Step title="Create a Kubernetes secret">
    Create a Kubernetes secret of the following form. Note that the structure of the secret is important and for a Elasticsearch API Key, it must have the top-level key token: ‘token-value’.

    ```yaml elastic-resolve-access-token.yml theme={null}
    apiVersion: v1
    kind: Secret
    type: Opaque
    metadata:
      name:  elasticsearch-resolve-access-token
    stringData:
      token: "<your elasticsearch API Key>"
    ```

    <Warning>
      **Security Best Practice:** Never store credentials in plaintext in configuration files or source control.
      Always use Kubernetes secrets and encrypt etcd or use enterprise secret management systems.
      See [Secret Management](/secret-management) for detailed guidance.
    </Warning>

    To apply the secret run

    ```shell apply secret theme={null}
    kubectl apply -f elasticsearch-resolve-access-token.yml
    ```
  </Step>

  <Step title="Configure your Elasticsearch API Key in the Resolve Satellite">
    Update your helm values override file with the following information (e.g.: *resolve-values.yaml*)

    ```yaml resolve-values.yaml theme={null}
    integrations:
      elasticsearchIntegration:
        type: elasticsearch
        create: true
        secretName:  "elastic-resolve-access-token"
        connection:
          url: "<your elastic server>"
    ```

    Install the satellite and apply the values from the yaml file that you have just updated. e.g.: *resolve-values.yaml.* To find the latest version, visit ResolveAI's docker hub repository for the [helm chart](https://hub.docker.com/r/resolveaihq/satellite-chart/tags) and [satellite image](https://hub.docker.com/r/resolveaihq/satellite/tags).

    ```shell apply config to satellite and redeploy theme={null}
    helm upgrade --install oci://registry-1.docker.io/resolveaihq/satellite-chart --version <LatestChart> --values resolve-values.yaml --set image.tag=<LatestImage>
    ```

    Once your satellite is deployed, we will automatically create an integration instance for you.
  </Step>

  <Step title="Verify your integration status in ResolveAI">
    Login to [https://app0.resolve.ai/](https://app0.resolve.ai/). Go to the integrations page and and select “Elasticsearch”

    You should see an automatically created integration based on the provided configuration.
  </Step>
</Steps>