How to Connect Elasticsearch to Microsoft Copilot via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Elasticsearch, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Elasticsearch + Microsoft Copilot

Let your AI explore and query your Elasticsearch cluster on Elastic Cloud, Serverless or your own servers: list indices and data streams, read mappings, search, aggregate, count, run ES|QL and, with your confirmation, write documents.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

ELASTICSEARCH_URL, ELASTICSEARCH_API_KEY

Step 1 — Get credentials

1. Find your Elasticsearch endpoint. Elastic Cloud Hosted: open the deployment at https://cloud.elastic.co and copy the Elasticsearch endpoint, e.g. https://my-deployment.es.europe-west3.gcp.cloud.es.io. Serverless: open the project and copy its Elasticsearch endpoint. Self-managed: the HTTPS address and port your cluster answers on, e.g. https://search.example.com:9200. Paste it into ELASTICSEARCH_URL without a trailing slash. Use the Elasticsearch endpoint, not the Kibana address.
2. Create an API key in Kibana under Stack Management → API keys → Create API key (Serverless: project settings → API keys). Name it, for example anythingmcp, set an expiry and turn on Control security privileges to limit it (see below).
3. Copy the Encoded value (base64): Elastic shows it only once. Paste it into ELASTICSEARCH_API_KEY and install the connector. The id and api_key values on their own do not work, and username and password are not supported.
4. Check the setup with elasticsearch_whoami: it needs no privileges and shows who the key belongs to.

Where your cluster runs: Elastic Cloud Hosted, Elastic Cloud Serverless and self-managed clusters, version 8 or later. AnythingMCP Cloud needs a cluster it can reach over the internet; a self-hosted AnythingMCP can also reach a cluster in your own network once an admin allows that host.

Read-only key (recommended): use these role descriptors in the Kibana form, or run the request in Kibana Dev Tools and copy encoded from the answer:

POST /_security/api_key
{
  "name": "anythingmcp-read",
  "expiration": "365d",
  "role_descriptors": {
    "anythingmcp_read": {
      "cluster": ["monitor"],
      "indices": [
        { "names": ["*"], "privileges": ["read", "view_index_metadata", "monitor"] }
      ]
    }
  }
}

Replace "*" with the index patterns the AI may see, e.g. ["products", "logs-*"]. read covers search, count, aggregations, ES|QL and single documents; view_index_metadata covers mappings, aliases and data streams; monitor covers the index list and cluster health. A key never has more rights than the user who creates it.

What the AI can do: list indices, aliases and data streams; read an index's field mapping before querying it; search with the Query DSL (10 hits by default, at most 100 per call); run aggregations such as counts per value, sums, averages and date histograms; count matches; run ES|QL queries for tabular answers (at most 500 rows); and read single documents. Common vector fields are left out of search results. Cluster health is not available on Serverless, where Elastic runs the cluster.

Writes ask first: elasticsearch_index_document creates or replaces a whole document, and elasticsearch_update_document changes some fields of one. Before each, the AI shows you the index, the _id and the content and waits for your yes. Both need the write privilege, so with the read-only key above they fail with 403, which is the intended safety net.

Switched off at install: elasticsearch_delete_document and elasticsearch_delete_by_query. Deletes cannot be undone, and a delete by query can remove millions of documents. An administrator turns them on deliberately; the AI then counts the matching documents first and asks before deleting.

Common errors: 401: the key is wrong, expired or invalidated, or the id was pasted instead of the Encoded value. 403 security_exception: the key lacks the privilege named in the message. 404 index_not_found_exception: unknown index name. 400 parsing_exception or verification_exception: the query has a mistake; the message names the field or position. 429: the cluster is overloaded; wait and retry.

The connector talks to Elasticsearch only, not to Kibana. It does not create or delete indices, change mappings or settings, or cover snapshots, ingest pipelines, security administration or the bulk API.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Microsoft Copilot

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Microsoft Copilot uses MCP servers through agents built in Copilot Studio: you add AnythingMCP to an agent as a tool, then publish the agent to Microsoft 365 Copilot and Teams. Copilot Studio connects from Microsoft's cloud over Streamable HTTP, which AnythingMCP supports.

1. In Copilot Studio, open your agent (or create one), go to Tools and choose Add a tool → New tool → Model Context Protocol.
2. Enter a Server name (for example AnythingMCP), a Server description that says what the connector does, and the Server URL https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID. Copilot Studio uses the description to decide when to call the server.
3. Under authentication, choose API key, set Type to Header and the header name to X-API-Key, then select Create.
4. In Add tool, choose Create a new connection, paste an MCP API key from AnythingMCP (MCP Servers → your server → API keys) and select Add to agent.
5. Try it in the agent's Test pane: ask for something that needs the Elasticsearch tools.
6. Select Publish, then Channels → Microsoft 365 and Microsoft Teams, keep Make agent available in Microsoft Copilot selected and choose Add channel. See agent in Teams installs it for you; in Microsoft 365 Copilot, type @ and pick the agent.

Prefer per-user sign-in? Choose OAuth 2.0 → Dynamic discovery instead of an API key: each user then signs in to AnythingMCP the first time the agent calls it.

Self-hosting? Use your instance's public HTTPS address instead of https://cloud.anythingmcp.com. Copilot Studio connects from Microsoft's cloud, so localhost does not work.

Available tools

Example prompts

• "Which indices do we have, how many documents does each hold and how big are they?"
• "Search the products index for wireless headphones under 100 euros and show name, brand and price."
• "With ES|QL, count the errors per host in logs- over the last 24 hours and show the top 10."*
• "How many orders per day did we get in September? Use a date histogram on the orders index."
• "Set the stock field of product 4711 in the products index to 0. Show me the change before you make it."

FAQ

Which Copilot is this for? Microsoft 365 Copilot at work, through agents built in Copilot Studio. The Microsoft Copilot app for personal accounts has no option to add your own MCP server.

What do I need? A work account with access to Copilot Studio (a license or a trial) to build the agent. People who use it in Microsoft 365 Copilot or Teams need access to the agent: share it with them, or ask an admin to publish it to the organization. If your organization applies data policies to Power Platform connectors, they cover MCP servers too.

The agent doesn't call the tools. Check that the header name is exactly X-API-Key and that the key belongs to the same MCP server as the URL, and make the server description specific: Copilot Studio uses it to decide when to call the server. Publish the agent again after each change; in an open chat, type "start over" to get the new version.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Cursor
• Connect to Gemini
• Connect to Meta Muse