Elasticsearch & OpenSearch Permissions
The Elasticsearch and OpenSearch tools (see Tools & Integrations) authenticate with an API key (recommended) or basic username and password. Both tools are read-only: CloudPeek searches and samples documents and reads index metadata; it never indexes, updates or deletes anything.
Create an API key (or role) with only these privileges, scoped to the index patterns you want investigable:
| Privilege | Description | Use case |
|---|---|---|
read (index privilege) | Search and retrieve documents in the granted indexes | Run search and multi-search queries and sample documents during investigations (search, msearch, sample tools) |
view_index_metadata (index privilege) | Read mappings and settings for the granted indexes | Read field mappings so the AI writes queries that match your schema (elasticsearch_list_mappings_for_index) |
monitor (cluster privilege, OpenSearch) | List indexes and basic statistics | Discover which indexes exist so searches target the right data (opensearch_list_indexes, served by the _cat/indices API) |
Note
Scope the API key to specific index patterns (for example logs-*, security-*) rather than *. The index pattern on the key is the hard boundary: CloudPeek cannot search, sample or read mappings for any index outside it.