RST AI Copilot for Elastic
An on-premises AI gateway for an existing Elasticsearch 8.x or 9.x deployment: natural-language log queries, alert triage and investigation, detection-rule generation.
Overview
RST AI Copilot for Elastic is an AI gateway delivered as Docker containers. It runs inside your network and connects to your existing Elasticsearch and Kibana (8.x or 9.x). It does not include Elasticsearch and does not copy your data. Analysts ask questions in plain language, and the gateway generates the query, runs it, and summarizes the result.
Features
| Feature | Description | License |
|---|---|---|
| Ask AI | Natural language to Elasticsearch query, dry-run repair, follow-up questions | Free |
| Field masking | Cloud, private, and air-gapped modes, applied before data leaves the cluster | Free |
| Posture, audit, knowledge base, baseline, asset ledger | Operational data, summarized and archived | Free |
| Alert batch triage | Clusters, scores, and ranks a batch of alerts | Paid |
| Alert investigation | Multi-round evidence gathering around one alert, with a verdict | Paid |
| Detection-rule generation | KQL and EQL rules from a description or a sample | Paid |
| Platform-ops copilot | Elastic cluster check-up and AI reading | Paid |
| Reports | Operations data summarized per period, with scheduled reports | Paid |
Without an activated license the gateway runs as Community: the free features work for 1 user. The paid features need a Professional or Enterprise license; Professional is licensed per user. A trial license opens every Enterprise feature for 14 days on one node. Every edition uses the same archive and the license decides what is unlocked; to upgrade, an administrator imports a license, with no reinstall.
The Community Edition is free. It includes every free feature and none of the four paid engines. Every edition uses the same archive, published on GitHub: Reallysec/RST-AI-Copilot-for-Elastic.