Grafana Learn
Sign in Sign up
Path

Learn when querying Elasticsearch directly from Grafana is the right choice for your logs and metrics.

Estimated time: 2 min

When to query Elasticsearch directly

Elasticsearch is a search and analytics engine used for log aggregation, application search, and infrastructure monitoring. Many teams already run Elasticsearch to store logs, metrics, and events.

The Elasticsearch data source in Grafana lets you query your existing Elasticsearch instance directly — your data stays where it is while Grafana provides the visualization, exploration, and alerting layer on top.

Key capabilities

The Grafana Elasticsearch data source supports:

  • Log queries — Search, filter, and explore log data with Lucene query syntax.
  • Metrics queries — Aggregate and visualize numeric data using bucket and metric aggregations.
  • Annotations — Overlay Elasticsearch events on your dashboard graphs.
  • Alerting — Create alerts based on Elasticsearch query results.
  • ES|QL queries — Query data using Elasticsearch’s pipe-based query language.

Refer to the Elasticsearch data source documentation for the full list of capabilities.

When to query Elasticsearch directly

Querying Elasticsearch directly is the right choice when:

  • You already have data in Elasticsearch and don’t want to duplicate it into another store
  • You need Elasticsearch’s native search capabilities like full-text Lucene search across log fields
  • Your Elasticsearch instance is accessible from Grafana Cloud (directly or via Private data source connect)
  • You want a unified view that combines Elasticsearch data with other data sources in a single dashboard

When to consider alternatives

If you use Amazon OpenSearch Service (the successor to Amazon Elasticsearch Service), use the OpenSearch data source instead. If you’re starting fresh and want log aggregation native to Grafana Cloud, consider sending logs to Grafana Loki.

In the next milestone, you’ll verify that your Elasticsearch instance is running and gather the details needed to connect.