> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abliteration.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Elastic / OpenSearch

> Index Policy Gateway events into Elasticsearch or Elastic Cloud via the Bulk API.

Stream Policy Gateway policy events to Elasticsearch or OpenSearch via the Bulk API.

## Configure

In the console, add a connector with:

| Field              | Value                            |
| ------------------ | -------------------------------- |
| Type               | Elastic                          |
| URL                | `https://<cluster>:9200`         |
| Auth               | API key or basic auth            |
| Index              | e.g. `ai-audit` or a data stream |
| CA cert (optional) | For self-signed clusters         |

## Event shape

Events are sent via `_bulk` as NDJSON:

```json theme={"system"}
{"index":{"_index":"ai-audit"}}
{"@timestamp":"2026-04-20T18:30:00Z","event_id":"3d14a2b8-...","event_type":"enforcement","policy_id":"support-bot","decision":"refuse","effective_decision":"allow","enforced":false,"rollout_mode":"shadow","reason_code":"REFUSE","policy_target":"chat.completions","project_id":"proj_support_bot","model":"abliterated-model","denylist_hits":["competitor-x"]}
```

## Index template

Recommended mapping:

```json theme={"system"}
{
  "mappings": {
    "properties": {
      "@timestamp":           { "type": "date" },
      "event_id":             { "type": "keyword" },
      "event_type":           { "type": "keyword" },
      "policy_id":             { "type": "keyword" },
      "decision":              { "type": "keyword" },
      "effective_decision":    { "type": "keyword" },
      "enforced":              { "type": "boolean" },
      "rollout_mode":          { "type": "keyword" },
      "reason_code":           { "type": "keyword" },
      "policy_target":         { "type": "keyword" },
      "project_id":            { "type": "keyword" },
      "model":                 { "type": "keyword" },
      "triggered_categories":  { "type": "keyword" },
      "allowlist_hits":        { "type": "keyword" },
      "denylist_hits":         { "type": "keyword" }
    }
  }
}
```

## Verify

```json theme={"system"}
GET ai-audit/_search
{ "query": { "term": { "decision": "refuse" } } }
```

See the full field list in [connectors](/policy-gateway/connectors).