Skip to content

Elasticsearch exporter metrics

Integration

The package uses dependency alias metrics for the locked prometheus-elasticsearch-exporter 7.4.0 values. Use that parent for upstream exporter options rather than an invented upstream wrapper. Package overrides select the Iron Bank exporter image and bootstrap credential reference. The exporter v1.11.0 guide describes authentication and collector permissions for the pinned image.

metrics.enabled installs the exporter. The package’s exporter ServiceMonitor requires both monitoring.enabled and metrics.enabled; the dashboard ConfigMap also requires dashboards.enabled. Istio proxy Services/ServiceMonitors have their own istio.enabled plus monitoring.enabled condition. These are distinct from Elastic Stack Monitoring in Kibana; a Kibana-to-Prometheus export is not installed. The umbrella supplies monitoring/metric-scraping settings. Direct chart users must provide a working Elasticsearch endpoint and Prometheus Operator CRDs where needed. The upstream exporter’s default endpoint is localhost, not automatic ECK discovery.

Authentication

The package defaults to ES_USERNAME=elastic and a password reference to logging-ek-es-elastic-user, key elastic. That name assumes the default umbrella release in logging. For production, provision a least-privilege credential with permissions appropriate for all enabled collectors and verify successful scrapes. Do not treat the old sample monitor-only role as sufficient for every collector.

For API-key authentication, reference a separately managed Secret instead of placing the key in a plain values file. Example package values (Secret/key must exist):

metrics:
  env:
    ES_USERNAME: ""
  extraEnvSecrets: null
  envFromSecret: elasticsearch-exporter-api-key

The referenced Secret must contain an ES_API_KEY entry. Setting the entire extraEnvSecrets map to null clears the inherited password reference; an empty map alone does not reliably clear inherited entries. Do not leave a null-valued individual entry in that map: the locked exporter template dereferences each entry. This example changes only authentication, not exporter enablement, endpoint, or TLS trust. Follow the upstream API-key creation and certificate configuration procedures through an authorized workflow; do not use curl -k, paste keys into shell arguments, or capture credentials in MR evidence.