[🔌 Provider]: Elastic to add compatibility support for ES 7.x

[lordofire]

Describe the provider you want to add
Elastic

Describe your use case
For the elasticsearch on-prem deployment, there is are some old ES versions deployed, which is not compatible with the current implementation.

Are you already using Keep?
Yes

Additional context
I got the following error when connecting to my 7.10 ES cluster:

{"worker_type": "uvicorn", "asctime": "2025-07-13 07:12:22,834", "message": "Error validating scopes", "levelname": "ERROR", "name": "elastic", "filename": "elastic_provider.py", "otelTraceID": "fb3120269fc0d14cd2f8d02d731be8f4", "otelSpanID": "fb77568039b39ecb", "otelTraceSampled": true, "otelServiceName": "keep-api", "threadName": "MainThread", "process": 21, "module": "elastic_provider", "exc_info": "Traceback (most recent call last):\n File \"/venv/lib/python3.11/site-packages/keep/providers/elastic_provider/elastic_provider.py\", line 171, in __initialize_client\n es.info()\n File \"/venv/lib/python3.11/site-packages/elasticsearch/_sync/client/utils.py\", line 455, in wrapped\n return api(*args, **kwargs)\n ^^^^^^^^^^^^^^^^^^^^\n File \"/venv/lib/python3.11/site-packages/elasticsearch/_sync/client/__init__.py\", line 2506, in info\n return self.perform_request( # type: ignore[return-value]\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/venv/lib/python3.11/site-packages/elasticsearch/_sync/client/_base.py\", line 271, in perform_request\n response = self._perform_request(\n ^^^^^^^^^^^^^^^^^^^^^^\n File \"/venv/lib/python3.11/site-packages/elasticsearch/_sync/client/_base.py\", line 363, in _perform_request\n raise UnsupportedProductError(\nelasticsearch.UnsupportedProductError: The client noticed that the server is not Elasticsearch and we do not support this unknown product\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/venv/lib/python3.11/site-packages/keep/providers/elastic_provider/elastic_provider.py\", line 193, in validate_scopes\n self.client.ping()\n ^^^^^^^^^^^\n File \"/venv/lib/python3.11/site-packages/keep/providers/elastic_provider/elastic_provider.py\", line 118, in client\n self._client = self.__initialize_client()\n ^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/venv/lib/python3.11/site-packages/keep/providers/elastic_provider/elastic_provider.py\", line 173, in __initialize_client\n raise ProviderConnectionFailed(\nkeep.exceptions.provider_connection_failed.ProviderConnectionFailed: Failed to connect to Elasticsearch: The client noticed that the server is not Elasticsearch and we do not support this unknown product"}

[dosubot]

Hi @lordofire! I'm Dosu and I’m helping the keep team.

Keep does not currently support Elasticsearch 7.x out of the box. The error you’re seeing happens because the elasticsearch-py v8 client (used by Keep) enforces strict product checks and will reject connections to ES 7.x unless compatibility mode is enabled or specific headers are set. The current Elastic provider implementation does not include any compatibility flags or adjustments for ES 7.x, and there’s no documented workaround or config option for this in the code or docs [source].

To add support for ES 7.x, the provider’s client initialization logic would need to be updated to enable compatibility mode or relax product checks as recommended in the elasticsearch-py docs for ES 7.x clusters. This typically involves passing compatibility_mode=True when creating the Elasticsearch client, or setting the appropriate Accept and Content-Type headers. Without this change, connections to ES 7.x will continue to fail with the error you described.

If you need implementation guidance or a code snippet for this adjustment, let me know!

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.