{
  "packaging_version": "2",
  "type": "elasticsearch",
  "name": "Elasticsearch",
  "version": "1.0.0",
  "min_app_version": "0.1.0",
  "description": "Search Elasticsearch indices for asset telemetry",
  "category": "Search & Analytics",
  "icon": "database",
  "supported_modes": ["batch"],
  "implementation": {
    "type": "container",
    "image": "ghcr.io/silentpulse/connector-elasticsearch:1.0.0",
    "resources": { "cpu": "100m", "memory": "256Mi" },
    "scaling": { "min_replicas": 1, "max_replicas": 4 },
    "health_check": { "command": ["/connector", "--healthcheck"], "interval": 30, "timeout": 5 },
    "build": { "repository": "https://github.com/silentpulse/connectors" }
  },
  "fields": [
    { "name": "url", "type": "url", "required": true, "group": "connection", "label": "URL", "description": "Elasticsearch cluster URL" },
    { "name": "api_key", "type": "password", "required": false, "group": "connection", "label": "API Key", "description": "Elasticsearch API key" },
    { "name": "username", "type": "text", "required": false, "group": "connection", "label": "Username" },
    { "name": "password", "type": "password", "required": false, "group": "connection", "label": "Password" },
    { "name": "skip_tls_verify", "type": "boolean", "required": false, "group": "connection", "label": "Skip TLS Verify" },
    { "name": "index", "type": "text", "required": true, "group": "query", "label": "Index", "description": "Index pattern to search" },
    { "name": "query", "type": "textarea", "required": false, "group": "query", "label": "Query", "default": "{\"match_all\":{}}" },
    { "name": "hostname_field", "type": "text", "required": true, "group": "query", "label": "Hostname Field", "default": "host.name" },
    { "name": "time_field", "type": "text", "required": false, "group": "query", "label": "Time Field", "default": "@timestamp" }
  ],
  "maintainer": {
    "name": "SilentPulse",
    "email": "support@silentpulse.io",
    "url": "https://silentpulse.io"
  },
  "repository": "https://github.com/silentpulse/connectors",
  "tags": ["search", "elasticsearch", "elastic", "opensearch", "analytics"],
  "readme": "# Elasticsearch Connector\n\nSearch Elasticsearch indices to detect which assets are actively generating security telemetry.\n\n## Requirements\n\n- Elasticsearch 7.x or 8.x (or OpenSearch 1.x/2.x)\n- Network access from SilentPulse to the cluster\n- API key or basic auth credentials\n\n## Configuration\n\nProvide the cluster URL, authentication, and index pattern. Optionally customize the query to filter specific event types.\n\n## Compatibility\n\nAlso works with OpenSearch clusters using the same API.",
  "notes": {
    "requirements": "Elasticsearch 7.0+ or OpenSearch 1.0+ with network access",
    "configuration": "Provide cluster URL and index pattern. API key or basic auth.",
    "limitations": "Scroll API used for large result sets. Max 10,000 hits per query by default."
  }
}