Provides tools for searching and analyzing logs stored in Elasticsearch clusters, including error pattern analysis, performance issue detection, cluster health monitoring, and index performance optimization through natural language queries.
Elasticsearch MCP Server
An AI-powered log analysis tool that connects Claude Desktop directly to your Elasticsearch cluster. Ask Claude questions about your logs in plain English and get intelligent insights.
What it does
Instead of writing complex Elasticsearch queries, just ask Claude things like:
- "Show me all 5xx errors from the last hour"
- "What's causing the slow database queries?"
- "Find unique IPs hitting my API in the last 5 minutes"
- "Is my Elasticsearch cluster healthy?"
Claude will search your logs, analyze patterns, and give you actionable insights.
Quick setup
1. Install dependencies
2. Build the extension
3. Install in Claude Desktop
- Double-click the generated
mcp-elasticsearch.dxt
file - Click "Install" when prompted
- Restart Claude Desktop
That's it! Now you can chat with your logs.
Real examples
You: "Find unique public IPs for ingress traffic in the last 5 minutes"
Configuration
The extension connects to localhost:9200
by default. To change this, edit the ES_HOST
in manifest.json
:
For secured clusters, you can add username/password through environment variables.
Requirements
- Elasticsearch 7.x or 8.x (tested with v8)
- Python 3.8+
- Claude Desktop (latest version)
- Node.js (for building the extension)
Troubleshooting
Extension won't install?
- Make sure you have the latest Claude Desktop
- Try removing old extensions first
Connection errors?
- Check if Elasticsearch is running
- Verify the host/port in your config
Still having issues?
What's included
The MCP server gives Claude these tools:
search_elasticsearch_logs
- Basic log searchinganalyze_error_patterns
- Find and categorize errorsanalyze_performance_issues
- Detect slow operationsget_cluster_health
- Monitor Elasticsearch healthanalyze_index_performance
- Optimize index performance
Time ranges
Use natural language for time ranges:
- "last 5 minutes", "1 hour", "2 days", "1 week"
- Or shortcuts like "5m", "1h", "2d", "1w"
License
MIT - use it however you want.
Ready to chat with your logs? Install the extension and start asking Claude questions about your Elasticsearch data!
This server cannot be installed
hybrid server
The server is able to function both locally and remotely, depending on the configuration or use case.
Enables Claude Desktop to connect directly to Elasticsearch clusters for intelligent log analysis through natural language queries. Users can ask questions about their logs in plain English and get actionable insights without writing complex Elasticsearch queries.