Elastic Observability

Elastic / Kibana alert webhooks POST JSON to Exhale. Each tenant gets a unique HTTPS URL token. Exhale scrubs the payload, upserts a Pulse (source=elastic), and runs triage when the alert state maps to active / firing / similar.

See Incoming integrations for how Elastic fits alongside PagerDuty, New Relic, and Manual webhook.

OpenAPI: POST /webhooks/elastic (header token) and POST /webhooks/elastic/{token}.

---

Endpoint

After Connect in Connections → Integrations → Observability & alerts → Elastic Observability:

Preferred (keeps tokens out of proxy access logs):

POST https://exhale.kolstromsystems.com/webhooks/elastic

Send header X-Exhale-Webhook-Token: {token}.

Path form (also supported):

POST https://exhale.kolstromsystems.com/webhooks/elastic/{token}

Design partners may substitute https://exhale-staging.kolstromsystems.com as the host.

• token — opaque URL segment; this token authenticates the delivery.
• Response: 202 Accepted with pulse_id, status, created, and message.

Unknown tokens return 404. Disabled or expired-trial tenants return 403.

---

Customer setup

1. Sign in as admin → Connections → Integrations → Elastic Observability.
2. Click Connect Elastic and copy the webhook URL.
3. In Kibana, add a Webhook connector / rule action and paste the Exhale URL.
4. Include an alert or rule id and a status field.
5. Send test alert creates a synthetic pulse and marks the integration configured.

Rotate webhook token invalidates the previous URL immediately — update Kibana after rotating.

---

Payload shape

Field	Required	Notes
Alert / rule id	Yes	Stable id for dedupe (source=elastic)
status / state	No	active, recovered, …
title / rule name	No	Pulse title

Lifecycle mapping

Elastic / Kibana state	Pulse status
Active, open, firing, new	Received → triage
Recovered, resolved, closed, ok	Resolved

Example

TOKEN="your-url-token"
curl -i -X POST "https://exhale.kolstromsystems.com/webhooks/elastic/${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"alert_id":"a-1","status":"active","title":"High error rate"}'

---

Related

Full detail (dedupe, fixtures, security): Elastic webhooks in the repository wiki. Planning track: Observability ingest v2.