Integration
Automate with Elasticsearch
Elasticsearch is the backbone of your search and logging infrastructure. NVS automates the operational workflows around it — monitoring cluster health, alerting on log anomalies, and managing indices.
Use Cases
When Elasticsearch detects an error rate spike in application logs — more than 5x the normal rate in a 5-minute window — the engineering team is alerted in Slack.
Trigger
Every 5 Minutes
schedule.cron
Error rate monitoring runs on a 5-minute interval.
Query Error Count
elasticsearch.query
Error log count for the last 5 minutes queried from the logs-* index.
IF
Rate > 5x Baseline?
nvs.condition
Current count compared to rolling average for the same window.
NO
Output
Done
nvs.end
Error rate is within normal bounds. No alert needed.
YES
Output
Alert #monitoring
slack.message
Slack alert: current error count, baseline, spike multiplier, and log query link.
Every day, Elasticsearch indices older than 30 days are identified and deleted automatically, keeping your cluster from accumulating stale log data.
Trigger
Daily 3am
schedule.cron
Index cleanup runs in the low-traffic overnight window.
List Old Indices
elasticsearch.api
Indices with creation date older than 30 days identified via the cat indices API.
IF
Old Indices Found?
nvs.condition
Checks whether cleanup candidates exist.
NO
Output
Done
nvs.end
All indices are within the retention window. No cleanup needed.
YES
Delete Old Indices
elasticsearch.api
DELETE request sent for each expired index.
Output
Log Cleanup
slack.message
Slack summary: indices deleted, storage freed, and remaining index count.
Every 10 minutes, the Elasticsearch cluster health endpoint is checked. If status is yellow or red, the infrastructure team is immediately alerted and a PagerDuty incident is created.
Trigger
Every 10 Minutes
schedule.cron
Cluster health monitoring runs on a frequent interval.
Check Cluster Health
elasticsearch.api
GET /_cluster/health endpoint queried for status, node count, and shard state.
IF
Status Not Green?
nvs.condition
Yellow or red status triggers the alert workflow.
NO
Output
Done
nvs.end
Cluster is green. All nodes and shards are healthy.
YES
Create PagerDuty Incident
pagerduty.incident
Incident created with cluster status, problem details, and health API response.
Output
Alert #infrastructure
slack.message
Slack alert: status color, affected nodes, unassigned shards, and incident link.
Ready to automate Elasticsearch?
We'll map your workflow, connect your tools, and build it in days, not months.
Book a Free Strategy Call →