Paste your Elasticsearch URL and Kibana URL. In Elastic Cloud, open https://cloud.elastic.co/home and copy both endpoints from the same deployment under the manage section.
In Settings, create an API key and paste it into SuperPlane. The key must be able to access Elasticsearch, Kibana cases, and Kibana connectors.
SuperPlane creates one Kibana Webhook connector per integration, shared across all triggers that use the same Kibana instance. Each incoming request is routed to the correct trigger using the eventType field in the request body — this trigger only processes requests where eventType is "alert_fired". Requests intended for other trigger types (e.g. "document_indexed") are silently ignored.
SuperPlane configures the rule action body with these fields:
{
"eventType": "alert_fired",
"ruleId": "{{rule.id}}",
"ruleName": "{{rule.name}}",
"spaceId": "{{rule.spaceId}}",
"tags": {{rule.tags}},
"severity": "{{context.severity}}",
"status": "{{rule.status}}"
}
The eventType field is required for routing. Kibana substitutes {{rule.id}} and {{rule.name}} at delivery time. Fields omitted from the body will not be filterable in SuperPlane.
Select at least one Rule. Additional filter fields are optional. When multiple values are provided in a list, any value matching is sufficient (OR). All active filter types must match simultaneously (AND across types).
Rule ID is the most reliable selector because rule names are user-editable. Use it when you need precise per-rule routing.
SuperPlane generates a random signing secret and configures the Kibana connector to include it on every request. Requests without the correct secret are rejected automatically.
Each received alert emits the parsed JSON body sent by Kibana directly as the event data. Use the workflow event timestamp to know when SuperPlane received it.
SuperPlane creates one Kibana Webhook connector per integration, shared across Elastic triggers that use the same Kibana instance. Each incoming request is routed to the correct trigger instance using two fields in the request body:
eventType: must be "case_status_changed".
routeKey: a unique ID assigned per trigger node so multiple case-status triggers can coexist safely.
SuperPlane creates one Kibana Webhook connector per integration, shared across all triggers that use the same Kibana instance. Each incoming request is routed to the correct trigger instance using two fields in the request body:
eventType: must be "document_indexed" — requests with any other value are silently ignored, allowing the shared connector to serve both this trigger and others (e.g. When Alert Fires).
routeKey: a unique ID assigned per trigger node — allows multiple On Document Indexed nodes on the same canvas to each react only to their own Kibana rule.
When the trigger is saved, SuperPlane creates or reuses the shared Kibana Webhook connector and provisions a Kibana Elasticsearch query rule for the configured index.
Every minute, the rule checks for documents with an @timestamp value within the current window. When matches are found, Kibana fires the connector.
SuperPlane receives the webhook, queries Elasticsearch for all documents newer than its stored checkpoint, and emits one event per document.
Provisioning happens when the live version is published. Autosave on a draft version does not create the connector or rule.
Index: The Elasticsearch index to monitor for new documents.
Note: This trigger requires an @timestamp field mapped as date on indexed documents. Documents without that field will be missed. To ensure all documents are captured, configure an ingest pipeline on the index to auto-populate the field if absent:
SuperPlane generates a random signing secret and configures the Kibana connector to include it on every request. Requests without the correct secret are rejected automatically.
The webhook acts as a signal. When it fires, SuperPlane queries Elasticsearch for documents newer than the stored checkpoint and emits one event per document containing its ID, index, and full source.
Index: The Elasticsearch index name to write to (e.g. workflow-audit)
Document: The JSON object to index. The editor starts with an @timestamp template so documents are compatible with On Document Indexed by default.
Document ID(optional): A stable ID for idempotent writes. If omitted, Elasticsearch generates one automatically. Providing an ID means re-runs update the existing document rather than creating a duplicate.
