kibana-connectors

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Kibana Connectors

Kibana 连接器

Core Concepts

核心概念

Connectors store connection information for Elastic services and third-party systems. Alerting rules use connectors to route actions (notifications) when rule conditions are met. Connectors are managed per Kibana Space and can be shared across all rules within that space.

连接器存储Elastic服务和第三方系统的连接信息。当告警规则满足触发条件时，会通过连接器路由动作（通知）。连接器按Kibana空间进行管理，可在该空间内的所有规则之间共享。

Connector Categories

连接器分类

Category	Connector Types
LLM Providers	OpenAI, Google Gemini, Amazon Bedrock, Elastic Managed LLMs, AI Connector, MCP (Preview, 9.3+)
Incident Management	PagerDuty, Opsgenie, ServiceNow (ITSM, SecOps, ITOM), Jira, Jira Service Management (9.2+), IBM Resilient, Swimlane, Torq, Tines, D3 Security, XSOAR (9.1+), TheHive
Endpoint Security	CrowdStrike, SentinelOne, Microsoft Defender for Endpoint
Messaging	Slack (API / Webhook), Microsoft Teams, Email
Logging & Observability	Server log, Index, Observability AI Assistant
Webhook	Webhook, Webhook - Case Management, xMatters
Elastic	Cases

分类	连接器类型
大语言模型提供商	OpenAI、Google Gemini、Amazon Bedrock、Elastic托管LLM、AI Connector、MCP（预览版，9.3+）
事件管理	PagerDuty、Opsgenie、ServiceNow（ITSM、SecOps、ITOM）、Jira、Jira Service Management（9.2+）、IBM Resilient、Swimlane、Torq、Tines、D3 Security、XSOAR（9.1+）、TheHive
终端安全	CrowdStrike、SentinelOne、Microsoft Defender for Endpoint
消息通知	Slack（API / Webhook）、Microsoft Teams、邮件
日志与可观测性	服务器日志、索引、可观测性AI助手
Webhook	Webhook、Webhook - 案例管理、xMatters
Elastic	案例管理

Authentication

认证

All connector API calls require API key auth or Basic auth. Every mutating request must include the

kbn-xsrf

header.

http

kbn-xsrf: true

所有连接器API调用都需要API密钥认证或基础认证。所有修改类请求必须包含

kbn-xsrf

请求头。

http

kbn-xsrf: true

Required Privileges

所需权限

Access to connectors is granted based on your privileges to alerting-enabled features. You need

all

privileges for Actions and Connectors in Stack Management.

连接器的访问权限基于您对告警功能的权限。您需要在Stack Management中拥有Actions and Connectors的

all

权限。

API Reference

API参考

Base path:

<kibana_url>/api/actions

(or

/s/<space_id>/api/actions

for non-default spaces).

Operation	Method	Endpoint
Create connector	POST	`/api/actions/connector/{id}`
Update connector	PUT	`/api/actions/connector/{id}`
Get connector	GET	`/api/actions/connector/{id}`
Delete connector	DELETE	`/api/actions/connector/{id}`
Get all connectors	GET	`/api/actions/connectors`
Get connector types	GET	`/api/actions/connector_types`
Run connector	POST	`/api/actions/connector/{id}/_execute`

基础路径：

<kibana_url>/api/actions

（非默认空间使用

/s/<space_id>/api/actions

）。

操作	请求方法	端点
创建连接器	POST	`/api/actions/connector/{id}`
更新连接器	PUT	`/api/actions/connector/{id}`
获取连接器详情	GET	`/api/actions/connector/{id}`
删除连接器	DELETE	`/api/actions/connector/{id}`
获取所有连接器列表	GET	`/api/actions/connectors`
获取连接器类型	GET	`/api/actions/connector_types`
测试连接器运行	POST	`/api/actions/connector/{id}/_execute`

Creating a Connector

创建连接器

Required Fields

必填字段

Field	Type	Description
`name`	string	Display name for the connector
`connector_type_id`	string	The connector type (e.g., `.slack` , `.email` , `.webhook` , `.pagerduty` , `.jira` )
`config`	object	Type-specific configuration (non-secret settings)
`secrets`	object	Type-specific secrets (API keys, passwords, tokens)

字段	类型	描述
`name`	字符串	连接器的显示名称
`connector_type_id`	字符串	连接器类型（例如： `.slack` , `.email` , `.webhook` , `.pagerduty` , `.jira` ）
`config`	对象	特定类型的配置（非敏感设置）
`secrets`	对象	特定类型的敏感信息（API密钥、密码、令牌）

Example: Create a Slack Connector (Webhook)

示例：创建Slack连接器（Webhook）

bash

curl -X POST "https://my-kibana:5601/api/actions/connector/my-slack-connector" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "Authorization: ApiKey <your-api-key>" \
  -d '{
    "name": "Production Slack Alerts",
    "connector_type_id": ".slack",
    "config": {},
    "secrets": {
      "webhookUrl": "https://hooks.slack.com/services/T00/B00/XXXX"
    }
  }'

All connector types share the same request structure — only

connector_type_id

config

, and

secrets

differ. See the Common Connector Type IDs table for available types and their required fields.

bash

curl -X POST "https://my-kibana:5601/api/actions/connector/my-slack-connector" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "Authorization: ApiKey <your-api-key>" \
  -d '{
    "name": "生产环境Slack告警",
    "connector_type_id": ".slack",
    "config": {},
    "secrets": {
      "webhookUrl": "https://hooks.slack.com/services/T00/B00/XXXX"
    }
  }'

所有连接器类型的请求结构相同 — 仅

connector_type_id

、

config

和

secrets

会有所不同。请查看常用连接器类型ID表格获取可用类型及其必填字段。

Example: Create a PagerDuty Connector

示例：创建PagerDuty连接器

bash

curl -X POST "https://my-kibana:5601/api/actions/connector/my-pagerduty" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "Authorization: ApiKey <your-api-key>" \
  -d '{
    "name": "PagerDuty Incidents",
    "connector_type_id": ".pagerduty",
    "config": {
      "apiUrl": "https://events.pagerduty.com/v2/enqueue"
    },
    "secrets": {
      "routingKey": "your-pagerduty-integration-key"
    }
  }'

bash

curl -X POST "https://my-kibana:5601/api/actions/connector/my-pagerduty" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "Authorization: ApiKey <your-api-key>" \
  -d '{
    "name": "PagerDuty事件",
    "connector_type_id": ".pagerduty",
    "config": {
      "apiUrl": "https://events.pagerduty.com/v2/enqueue"
    },
    "secrets": {
      "routingKey": "your-pagerduty-integration-key"
    }
  }'

Updating a Connector

更新连接器

PUT /api/actions/connector/{id}

replaces the full configuration.

connector_type_id

is immutable — delete and recreate to change it.

PUT /api/actions/connector/{id}

会替换完整的配置。

connector_type_id

是不可变的 — 如需修改类型，需删除并重新创建连接器。

Listing and Discovering Connectors

列出和发现连接器

bash

undefined

bash

undefined

Get all connectors in the current space

获取当前空间下的所有连接器

curl -X GET "https://my-kibana:5601/api/actions/connectors"
-H "Authorization: ApiKey <your-api-key>"

Get available connector types

获取可用的连接器类型

curl -X GET "https://my-kibana:5601/api/actions/connector_types"
-H "Authorization: ApiKey <your-api-key>"

Filter connector types by feature (e.g., only those supporting alerting)

按功能过滤连接器类型（例如：仅支持告警的类型）

curl -X GET "https://my-kibana:5601/api/actions/connector_types?feature_id=alerting"
-H "Authorization: ApiKey <your-api-key>"


The `GET /api/actions/connectors` response includes `referenced_by_count` showing how many rules use each connector.
Always check this before deleting.

curl -X GET "https://my-kibana:5601/api/actions/connector_types?feature_id=alerting"
-H "Authorization: ApiKey <your-api-key>"


`GET /api/actions/connectors`的响应包含`referenced_by_count`字段，显示有多少规则正在使用该连接器。删除前请务必检查该字段。

Running a Connector (Test)

测试连接器运行

Execute a connector action directly, useful for testing connectivity.

bash

curl -X POST "https://my-kibana:5601/api/actions/connector/my-slack-connector/_execute" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "Authorization: ApiKey <your-api-key>" \
  -d '{
    "params": {
      "message": "Test alert from API"
    }
  }'

直接执行连接器动作，用于测试连通性。

bash

curl -X POST "https://my-kibana:5601/api/actions/connector/my-slack-connector/_execute" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "Authorization: ApiKey <your-api-key>" \
  -d '{
    "params": {
      "message": "来自API的测试告警"
    }
  }'

Deleting a Connector

删除连接器

bash

curl -X DELETE "https://my-kibana:5601/api/actions/connector/my-slack-connector" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey <your-api-key>"

Warning: Deleting a connector that is referenced by rules will cause those rule actions to fail silently. Check

referenced_by_count

first.

bash

curl -X DELETE "https://my-kibana:5601/api/actions/connector/my-slack-connector" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey <your-api-key>"

警告： 删除被规则引用的连接器会导致这些规则的动作静默失败。请先检查

referenced_by_count

字段。

Terraform Provider

Terraform提供商

Use the

elasticstack

provider resource

elasticstack_kibana_action_connector

hcl

terraform {
  required_providers {
    elasticstack = {
      source  = "elastic/elasticstack"
    }
  }
}

provider "elasticstack" {
  kibana {
    endpoints = ["https://my-kibana:5601"]
    api_key   = var.kibana_api_key
  }
}

resource "elasticstack_kibana_action_connector" "slack" {
  name              = "Production Slack Alerts"
  connector_type_id = ".slack"

  config = jsonencode({})

  secrets = jsonencode({
    webhookUrl = "https://hooks.slack.com/services/T00/B00/XXXX"
  })
}

resource "elasticstack_kibana_action_connector" "index" {
  name              = "Alert Index Writer"
  connector_type_id = ".index"

  config = jsonencode({
    index              = "alert-history"
    executionTimeField = "@timestamp"
  })

  secrets = jsonencode({})
}

Key Terraform notes:

```
config
```
and
```
secrets
```
must be JSON-encoded strings via
```
jsonencode()
```
Secrets are stored in Terraform state; use a remote backend with encryption and restrict state file access

Import existing connectors:

terraform import elasticstack_kibana_action_connector.my_connector <space_id>/<connector_id>

(use

default

for the default space)

After import, secrets are not populated in state; you must supply them in config

使用

elasticstack

提供商的资源

elasticstack_kibana_action_connector

。

hcl

terraform {
  required_providers {
    elasticstack = {
      source  = "elastic/elasticstack"
    }
  }
}

provider "elasticstack" {
  kibana {
    endpoints = ["https://my-kibana:5601"]
    api_key   = var.kibana_api_key
  }
}

resource "elasticstack_kibana_action_connector" "slack" {
  name              = "生产环境Slack告警"
  connector_type_id = ".slack"

  config = jsonencode({})

  secrets = jsonencode({
    webhookUrl = "https://hooks.slack.com/services/T00/B00/XXXX"
  })
}

resource "elasticstack_kibana_action_connector" "index" {
  name              = "告警索引写入器"
  connector_type_id = ".index"

  config = jsonencode({
    index              = "alert-history"
    executionTimeField = "@timestamp"
  })

  secrets = jsonencode({})
}

Terraform关键注意事项：

```
config
```
和
```
secrets
```
必须通过
```
jsonencode()
```
转换为JSON编码字符串
敏感信息会存储在Terraform状态中；请使用带加密的远程后端并限制状态文件的访问权限

导入现有连接器：

terraform import elasticstack_kibana_action_connector.my_connector <space_id>/<connector_id>

（默认空间使用

default

）

导入后，状态中不会包含敏感信息；您必须在配置中重新提供

Preconfigured Connectors (On-Prem)

预配置连接器（本地部署）

For self-managed Kibana, connectors can be preconfigured in

kibana.yml

so they are available at startup without manual creation:

yaml

xpack.actions.preconfigured:
  my-slack-connector:
    name: "Production Slack"
    actionTypeId: .slack
    secrets:
      webhookUrl: "https://hooks.slack.com/services/T00/B00/XXXX"
  my-webhook:
    name: "Custom Webhook"
    actionTypeId: .webhook
    config:
      url: "https://api.example.com/alerts"
      method: post
      hasAuth: true
    secrets:
      user: "alert-user"
      password: "secret-password"

Preconfigured connectors cannot be edited or deleted via the API or UI. They show

is_preconfigured: true

and omit

config

and

is_missing_secrets

from API responses.

对于自托管Kibana，可在

kibana.yml

中预配置连接器，使其在启动时即可使用，无需手动创建：

yaml

xpack.actions.preconfigured:
  my-slack-connector:
    name: "生产环境Slack"
    actionTypeId: .slack
    secrets:
      webhookUrl: "https://hooks.slack.com/services/T00/B00/XXXX"
  my-webhook:
    name: "自定义Webhook"
    actionTypeId: .webhook
    config:
      url: "https://api.example.com/alerts"
      method: post
      hasAuth: true
    secrets:
      user: "alert-user"
      password: "secret-password"

预配置的连接器无法通过API或UI进行编辑或删除。它们在API响应中会显示

is_preconfigured: true

，并且不会返回

config

和

is_missing_secrets

字段。

Networking Configuration

网络配置

Customize connector networking (proxies, TLS, certificates) via

kibana.yml

yaml

undefined

可通过

kibana.yml

自定义连接器的网络设置（代理、TLS、证书）：

yaml

undefined

Global proxy for all connectors

所有连接器的全局代理

xpack.actions.proxyUrl: "https://proxy.example.com:8443"

Per-host TLS settings

按主机配置TLS设置

xpack.actions.customHostSettings:

url: "https://api.example.com" ssl: verificationMode: full certificateAuthoritiesFiles: ["/path/to/ca.pem"]

undefined

xpack.actions.customHostSettings:

url: "https://api.example.com" ssl: verificationMode: full certificateAuthoritiesFiles: ["/path/to/ca.pem"]

undefined

Connectors in Kibana Workflows

Kibana工作流中的连接器

Connectors serve as the integration layer across multiple Kibana workflows, not just alerting notifications:

Workflow	Connector Types	Key Pattern
ITSM ticketing	ServiceNow, Jira, IBM Resilient	Create ticket on active, close on `Recovered`
On-call escalation	PagerDuty, Opsgenie	`trigger` on active, `resolve` on `Recovered` ; always set a deduplication key
Case management	Cases (system action)	UI-only; groups alerts into investigation Cases; can auto-push to ITSM
Messaging / awareness	Slack, Teams, Email	`onActionGroupChange` for incident channels; summaries for monitoring channels
Audit logging	Index	`onActiveAlert` to write full alert time-series to Elasticsearch
AI workflows	OpenAI, Bedrock, Gemini, AI Connector	Powers Elastic AI Assistant and Attack Discovery; system-managed
Custom integrations	Webhook	Generic HTTP outbound with Mustache-templated JSON body

For detailed patterns, examples, and decision guidance for each workflow, see workflows.md.

连接器是多个Kibana工作流的集成层，而不仅仅用于告警通知：

工作流	连接器类型	核心模式
ITSM工单	ServiceNow、Jira、IBM Resilient	触发时创建工单，恢复时关闭工单
值班升级	PagerDuty、Opsgenie	触发时 `trigger` ，恢复时 `resolve` ；始终设置去重键
案例管理	Cases（系统动作）	仅支持UI；将告警分组为调查案例；可自动推送到ITSM
消息通知 / 同步	Slack、Teams、邮件	针对事件频道使用 `onActionGroupChange` ；针对监控频道发送摘要
审计日志	Index	触发告警时将完整告警时间序列写入Elasticsearch
AI工作流	OpenAI、Bedrock、Gemini、AI Connector	为Elastic AI助手和攻击发现提供支持；由系统管理
自定义集成	Webhook	支持Mustache模板JSON请求体的通用HTTP出站集成

有关每个工作流的详细模式、示例和决策指南，请参阅workflows.md。

Best Practices

最佳实践

Use preconfigured connectors for production on-prem. They eliminate secret sprawl, survive Saved Object imports, and cannot be accidentally deleted. Reserve API-created connectors for dynamic or user-managed scenarios.
Test connectors before attaching to rules. Use the
```
_execute
```
endpoint to verify connectivity. A misconfigured connector causes silent action failures that only appear in the rule's execution history.
Check
referenced_by_count
before deleting. Deleting a connector used by active rules causes those actions to fail. List connectors and verify zero references, or reassign rules to a new connector first.
Use the Email domain allowlist. The
```
xpack.actions.email.domain_allowlist
```
setting restricts which email domains connectors can send to. If you update this list, existing email connectors with recipients outside the new list will start failing.
Secure secrets in Terraform. Connector secrets (API keys, passwords, webhook URLs) are stored in Terraform state. Use encrypted remote backends (S3+KMS, Azure Blob+encryption, GCS+CMEK) and restrict access to state files. Use
```
sensitive = true
```
on variables.
One connector per service, not per rule. Create a single Slack connector and reference it from multiple rules. This centralizes secret rotation and reduces duplication.
Use Spaces for multi-tenant isolation. Connectors are scoped to a Kibana Space. Create separate spaces for different teams or environments and configure connectors per space.
Monitor connector health. Failed connector executions are logged in the event log index (
```
.kibana-event-log-*
```
). Connector failures report as successful to Task Manager but fail silently for alert delivery. Check the Event Log Index for true failure rates.
Always configure a recovery action alongside the active action. Connectors for ITSM and on-call tools (ServiceNow, Jira, PagerDuty, Opsgenie) support a close/resolve operation. Without a recovery action, incidents remain open forever.
Use deduplication keys for on-call connectors. Set
```
dedupKey
```
(PagerDuty) or
```
alias
```
(Opsgenie) to
```
{{rule.id}}-{{alert.id}}
```
to ensure the resolve event closes exactly the right incident. Without this, a new incident is created every time the alert re-fires.
Prefer the Cases connector for investigation workflows. When an alert requires investigation with comments, attachments, and assignees, use Cases rather than a direct Jira/ServiceNow connector. Cases gives you a native investigation UI and can still push to ITSM via the Case's external connection.
Use the Index connector for durable audit trails. The Index connector writes to Elasticsearch, making alert history searchable and dashboardable. Pair it with an ILM policy on the target index to control retention.
Restrict connector access via Action settings. Use
```
xpack.actions.enabledActionTypes
```
to allowlist only the connector types your organization needs, and
```
xpack.actions.allowedHosts
```
to restrict outbound connections to known endpoints.

生产环境本地部署使用预配置连接器。它们可避免敏感信息扩散，在导入Saved Object时不会丢失，且无法被意外删除。将API创建的连接器保留给动态或用户管理的场景。
在关联规则前测试连接器。使用
```
_execute
```
端点验证连通性。配置错误的连接器会导致动作静默失败，仅会在规则的执行历史中显示。
删除前检查
referenced_by_count
。删除被活跃规则引用的连接器会导致这些动作失败。先列出连接器并确认引用数为零，或者先将引用规则重新关联到新连接器，再执行删除操作。
使用邮件域名白名单。
```
xpack.actions.email.domain_allowlist
```
设置可限制连接器能发送邮件的域名。如果更新此列表，现有收件人不在新列表中的邮件连接器将开始失败。
在Terraform中保护敏感信息。连接器的敏感信息（API密钥、密码、Webhook URL）会存储在Terraform状态中。使用加密的远程后端（S3+KMS、Azure Blob+加密、GCS+CMEK）并限制状态文件的访问权限。在变量上设置
```
sensitive = true
```
。
每个服务使用一个连接器，而非每个规则一个。创建一个Slack连接器并在多个规则中引用它。这样可集中管理敏感信息轮换，减少重复配置。
使用空间实现多租户隔离。连接器是Kibana空间级别的资源。为不同团队或环境创建单独的空间，并按空间配置连接器。
监控连接器健康状态。连接器执行失败会记录在事件日志索引（
```
.kibana-event-log-*
```
）中。连接器失败会向任务管理器报告为成功，但告警交付会静默失败。请查看事件日志索引获取真实的失败率。
始终为触发动作配置恢复动作。ITSM和值班工具（ServiceNow、Jira、PagerDuty、Opsgenie）的连接器支持关闭/解决操作。如果没有恢复动作，事件将永远保持打开状态。
为值班连接器配置去重键。将
```
dedupKey
```
（PagerDuty）或
```
alias
```
（Opsgenie）设置为
```
{{rule.id}}-{{alert.id}}
```
，确保恢复事件能准确关闭对应的事件。如果不设置，每次告警重新触发时都会创建新事件。
调查工作流优先使用Cases连接器。当告警需要包含评论、附件和负责人的调查时，使用Cases而非直接的Jira/ServiceNow连接器。Cases提供原生的调查UI，仍可通过Case的外部连接推送到ITSM。
使用Index连接器实现持久化审计追踪。Index连接器写入Elasticsearch，使告警历史可搜索和可视化。为目标索引配置ILM策略以控制保留时间。
通过Action设置限制连接器访问。使用
```
xpack.actions.enabledActionTypes
```
仅允许组织需要的连接器类型，使用
```
xpack.actions.allowedHosts
```
限制出站连接到已知端点。

Common Pitfalls

常见陷阱

Missing
kbn-xsrf
header. All POST, PUT, DELETE requests require
```
kbn-xsrf: true
```
. Omitting it returns a 400 error.
Wrong
connector_type_id
. Use the exact string including the leading dot (e.g.,
```
.slack
```
, not
```
slack
```
). Discover valid types via
```
GET /api/actions/connector_types
```
.
Empty
secrets
object required. Even for connectors without secrets (e.g.,
```
.index
```
,
```
.server-log
```
), you must provide
```
"secrets": {}
```
in the create request.
Connector type is immutable. You cannot change the
```
connector_type_id
```
after creation. Delete and recreate instead.
Secrets lost on export/import. Exporting connectors via Saved Objects strips secrets. After import, connectors show
```
is_missing_secrets: true
```
and a "Fix" button appears in the UI. You must re-enter secrets manually or via API.
Preconfigured connectors cannot be modified via API. Attempting to update or delete a preconfigured connector returns 400. Manage them exclusively in
```
kibana.yml
```
.
Rate limits from third-party services. Connectors that send high volumes of notifications (e.g., one per alert every minute) can hit Slack, PagerDuty, or email provider rate limits. Use alert summaries and action frequency controls on the rule side to reduce volume.
Connector networking failures. Kibana must be able to reach the connector's target URL. Verify firewall rules, proxy settings, and DNS resolution. Use
```
xpack.actions.customHostSettings
```
for TLS issues.
License requirements. Some connector types require a Gold, Platinum, or Enterprise license. Check the
```
minimum_license_required
```
field from
```
GET /api/actions/connector_types
```
. A connector that is
```
enabled_in_config: true
```
but
```
enabled_in_license: false
```
cannot be used.
Terraform import does not restore secrets. When importing an existing connector into Terraform, the secrets are not read back from Kibana. You must provide them in your Terraform configuration, or the next
```
terraform apply
```
will overwrite them with empty values.

缺少
kbn-xsrf
请求头。所有POST、PUT、DELETE请求都需要
```
kbn-xsrf: true
```
。省略该头会返回400错误。
错误的
connector_type_id
。使用包含前导点的精确字符串（例如：
```
.slack
```
，而非
```
slack
```
）。可通过
```
GET /api/actions/connector_types
```
获取有效类型。
必须提供空的
secrets
对象。即使是没有敏感信息的连接器（例如：
```
.index
```
,
```
.server-log
```
），您也必须在创建请求中提供
```
"secrets": {}
```
。
连接器类型不可变。创建后无法修改
```
connector_type_id
```
。需删除并重新创建。
导出/导入时丢失敏感信息。通过Saved Objects导出连接器会移除敏感信息。导入后，连接器会显示
```
is_missing_secrets: true
```
，UI中会出现“修复”按钮。您必须手动或通过API重新输入敏感信息。
预配置连接器无法通过API修改。尝试更新或删除预配置连接器会返回400错误。请仅通过
```
kibana.yml
```
管理它们。
第三方服务的速率限制。发送大量通知的连接器（例如：每分钟每个告警发送一次）可能会触发Slack、PagerDuty或邮件提供商的速率限制。使用告警摘要和规则端的动作频率控制来减少发送量。
连接器网络失败。Kibana必须能够访问连接器的目标URL。请验证防火墙规则、代理设置和DNS解析。针对TLS问题使用
```
xpack.actions.customHostSettings
```
。
许可证要求。部分连接器类型需要Gold、Platinum或Enterprise许可证。请查看
```
GET /api/actions/connector_types
```
返回的
```
minimum_license_required
```
字段。如果连接器
```
enabled_in_config: true
```
但
```
enabled_in_license: false
```
，则无法使用。
Terraform导入不会恢复敏感信息。将现有连接器导入Terraform时，不会从Kibana读取敏感信息。您必须在Terraform配置中提供，否则下一次
```
terraform apply
```
会将其覆盖为空值。

Common Connector Type IDs

常用连接器类型ID

Type ID	Name	License
`.email`	Email	Gold
`.slack`	Slack (Webhook)	Gold
`.slack_api`	Slack (API)	Gold
`.pagerduty`	PagerDuty	Gold
`.jira`	Jira	Gold
`.servicenow`	ServiceNow ITSM	Platinum
`.servicenow-sir`	ServiceNow SecOps	Platinum
`.servicenow-itom`	ServiceNow ITOM	Platinum
`.webhook`	Webhook	Gold
`.index`	Index	Basic
`.server-log`	Server log	Basic
`.opsgenie`	Opsgenie	Gold
`.teams`	Microsoft Teams	Gold
`.gen-ai`	OpenAI	Enterprise
`.bedrock`	Amazon Bedrock	Enterprise
`.gemini`	Google Gemini	Enterprise
`.cases`	Cases	Platinum
`.crowdstrike`	CrowdStrike	Enterprise
`.sentinelone`	SentinelOne	Enterprise
`.microsoft_defender_endpoint`	Microsoft Defender for Endpoint	Enterprise
`.thehive`	TheHive	Gold

Note: Use
GET /api/actions/connector_types
to discover all available types on your deployment along with their exact
minimum_license_required
values. Connector types for XSOAR, Jira Service Management, and MCP are available but may not appear in older API spec versions.

类型ID	名称	许可证
`.email`	邮件	Gold
`.slack`	Slack（Webhook）	Gold
`.slack_api`	Slack（API）	Gold
`.pagerduty`	PagerDuty	Gold
`.jira`	Jira	Gold
`.servicenow`	ServiceNow ITSM	Platinum
`.servicenow-sir`	ServiceNow SecOps	Platinum
`.servicenow-itom`	ServiceNow ITOM	Platinum
`.webhook`	Webhook	Gold
`.index`	Index	Basic
`.server-log`	服务器日志	Basic
`.opsgenie`	Opsgenie	Gold
`.teams`	Microsoft Teams	Gold
`.gen-ai`	OpenAI	Enterprise
`.bedrock`	Amazon Bedrock	Enterprise
`.gemini`	Google Gemini	Enterprise
`.cases`	Cases	Platinum
`.crowdstrike`	CrowdStrike	Enterprise
`.sentinelone`	SentinelOne	Enterprise
`.microsoft_defender_endpoint`	Microsoft Defender for Endpoint	Enterprise
`.thehive`	TheHive	Gold

注意： 使用
GET /api/actions/connector_types
可发现您部署中所有可用的类型及其确切的
minimum_license_required
值。XSOAR、Jira Service Management和MCP的连接器类型可用，但可能不会出现在旧版API规范中。

Examples

示例场景

Create a Slack connector: "Set up Slack notifications for our alerts."

POST /api/actions/connector

with

connector_type_id: ".slack"

and

secrets.webhookUrl

. Use the returned connector

id

in rule actions.

Test a connector before attaching to rules: "Verify the PagerDuty connector works."

POST /api/actions/connector/{id}/_execute

with a minimal params object to confirm connectivity before adding to any rule.

Audit connector usage before deletion: "Remove the old email connector."

GET /api/actions/connectors

, inspect

referenced_by_count

— if non-zero, reassign the referencing rules first, then

DELETE /api/actions/connector/{id}

创建Slack连接器： "为我们的告警设置Slack通知。" 使用

POST /api/actions/connector

，指定

connector_type_id: ".slack"

和

secrets.webhookUrl

。在规则动作中使用返回的连接器

id

。

关联规则前测试连接器： "验证PagerDuty连接器是否可用。" 使用

POST /api/actions/connector/{id}/_execute

并传入最小化的params对象，在关联到任何规则前确认连通性。

删除前审计连接器使用情况： "移除旧的邮件连接器。" 调用

GET /api/actions/connectors

，检查

referenced_by_count

— 如果不为零，先将引用的规则重新关联到其他连接器，再执行

DELETE /api/actions/connector/{id}

。

Guidelines

通用指南

Include
```
kbn-xsrf: true
```
on every POST, PUT, and DELETE; omitting it returns 400.
```
connector_type_id
```
is immutable — delete and recreate to change connector type.
Always pass
```
"secrets": {}
```
even for connectors with no secrets (e.g.,
```
.index
```
,
```
.server-log
```
).
Check
```
referenced_by_count
```
before deleting; a deleted connector silently breaks all referencing rule actions.
Connectors are space-scoped; prefix paths with
```
/s/<space_id>/api/actions/
```
for non-default Kibana Spaces.
Secrets are write-only: not returned by GET and stripped on Saved Object export/import; always re-supply after import.
Test every new connector with
```
_execute
```
before attaching to rules; connector failures in production are silent.

所有POST、PUT和DELETE请求都必须包含
```
kbn-xsrf: true
```
；省略会返回400错误。
```
connector_type_id
```
不可变 — 如需修改连接器类型，需删除并重新创建。
即使是没有敏感信息的连接器（例如：
```
.index
```
,
```
.server-log
```
），也必须传入
```
"secrets": {}
```
。
删除前检查
```
referenced_by_count
```
；被删除的连接器会静默破坏所有引用它的规则动作。
连接器是空间级别的资源；对于非默认Kibana空间，路径需前缀
```
/s/<space_id>/api/actions/
```
。
敏感信息是只写的：不会被GET请求返回，在Saved Object导出/导入时会被移除；导入后必须重新提供。
关联到规则前，务必使用
```
_execute
```
测试每个新连接器；生产环境中的连接器失败是静默的。

kibana-connectors

Original

Translation

Kibana Connectors

Kibana 连接器

Core Concepts

核心概念

Connector Categories

连接器分类

Authentication

认证

Required Privileges

所需权限

API Reference

API参考

Creating a Connector

创建连接器

Required Fields

必填字段

Example: Create a Slack Connector (Webhook)

示例：创建Slack连接器（Webhook）

Example: Create a PagerDuty Connector

示例：创建PagerDuty连接器

Updating a Connector

更新连接器

Listing and Discovering Connectors

列出和发现连接器

Get all connectors in the current space

获取当前空间下的所有连接器

Get available connector types

获取可用的连接器类型

Filter connector types by feature (e.g., only those supporting alerting)

按功能过滤连接器类型（例如：仅支持告警的类型）

Running a Connector (Test)

测试连接器运行

Deleting a Connector

删除连接器

Terraform Provider

Terraform提供商

Preconfigured Connectors (On-Prem)

预配置连接器（本地部署）

Networking Configuration

网络配置

Global proxy for all connectors

所有连接器的全局代理

Per-host TLS settings

按主机配置TLS设置

Connectors in Kibana Workflows

Kibana工作流中的连接器

Best Practices

最佳实践

Common Pitfalls

常见陷阱

Common Connector Type IDs

常用连接器类型ID

Examples

示例场景

Guidelines

通用指南

Additional Resources

额外资源