kibana-connectors

Creating and managing Kibana connectors - the stored connection details that let alerting rules route actions to third-party systems - is the focus of this skill, which works through the REST API or Terraform. Connectors hold connection information for Elastic services and external systems, are managed per Kibana Space, and can be shared across all rules in that space. Supported categories span LLM providers, incident management (PagerDuty, Opsgenie, ServiceNow, Jira, and more), endpoint security, messaging (Slack, Microsoft Teams, Email), logging and observability, webhooks, and Elastic Cases.

Authentication uses API key or Basic auth, and every mutating request must include the kbn-xsrf: true header; the required privilege is all for Actions and Connectors in Stack Management. The REST API lives under the base path /api/actions (or /s/<space_id>/api/actions for non-default spaces) and exposes operations to create, update, get, delete, and list connectors, list connector types, and run a connector. Creating a connector requires four fields: a display name, a connector_type_id such as .slack or .pagerduty, a non-secret config object, and a secrets object for API keys, passwords, and tokens - all connector types share this request shape and differ only in those three values. Worked curl examples show creating a Slack webhook connector and a PagerDuty connector.

Operational guidance covers the rest of the lifecycle. Updating uses PUT to replace the full configuration, and connector_type_id is immutable, so changing type means delete and recreate. Listing returns a referenced_by_count showing how many rules use each connector, which should always be checked before deleting - deleting a referenced connector makes those rule actions fail silently. A connector can be run via the _execute endpoint to test connectivity. For managing connectors as code, the elasticstack Terraform provider offers the elasticstack_kibana_action_connector resource, with config and secrets passed as JSON-encoded objects, illustrated for both Slack and index connectors.