What Happened
Kibana now offers more than 90 AI connectors, including Slack, GitHub, Confluence, PagerDuty, Gmail, and Google Drive. An agent can call these services as tools alongside Elasticsearch queries, rather than requiring a custom integration for each service or copying all external data into a search index [1]. That makes it possible to connect an indexed security alert with a code change or incident timeline, for example.
The important distinction is tool access versus indexed retrieval. A connector can fetch current context from a source system; a search index can retrieve relevant content efficiently across a prepared corpus. Most production RAG applications need a deliberate mix of both.
Why It Matters to Businesses
Better retrieval is often more valuable than a larger model. Missing documents, stale indexes and incorrect permissions can produce confident answers with incomplete or unauthorized evidence. Connectors may reduce the time spent gathering context during an incident, but that benefit depends on source availability, authorization and whether the agent chooses the right tool [1].
Teams comparing Elasticsearch, Vespa, Weaviate, Pinecone, Qdrant or Milvus should therefore evaluate the complete retrieval workflow—not vector similarity alone. LlamaIndex, LangChain and Haystack can help orchestrate that workflow, but they do not replace decisions about indexing, access control, ranking and evaluation.
Kimbodo Engineering Perspective
We would start with the questions users must answer and the evidence those answers require. Keyword search is strong for exact identifiers; vector search helps with semantic matches. Hybrid retrieval followed by reranking is a sensible baseline, not an automatic winner: its extra complexity and latency must earn their place in tests against real queries.
We would use indexed retrieval for frequently searched, permissioned content and live tool calls for information that changes quickly or should remain in its source system. Every answer should identify its evidence and distinguish a failed or unavailable source from a genuine absence of results. Framework and database choices follow those requirements, not the other way around.
How We Would Implement It
- Define an evidence contract: Specify supported questions, authoritative sources, freshness requirements, citation format and what the assistant must do when evidence is insufficient.
- Build the retrieval path: Ingest approved content, retain source IDs and permission metadata, chunk and index it, then test keyword, vector and hybrid candidates with reranking. Filter access before material reaches the model.
- Add live tools selectively: Use connectors for current Slack, GitHub or incident context where appropriate. Kibana connectors support OAuth, API keys and bearer tokens, with user authorization for personal data or an administrator-configured account for shared organizational data [1].
- Evaluate end to end: Measure whether the right evidence is retrieved, whether answers are supported, permission failures, freshness, latency and cost. Include adversarial documents and multi-source questions in the test set.
- Operate it as a service: Monitor ingestion lag, connector errors, retrieval quality and tool-call traces; version indexes and prompts so regressions can be investigated and rolled back.
Risks, Costs and Security
Live connectors expand the agent’s reach and its attack surface. Apply least-privilege scopes, separate user and shared-account access, restrict write-capable tools, log access and treat retrieved text as untrusted input. A system-account connector must not become a shortcut around a user’s document permissions [1].
Vector storage, embedding updates, reranking and repeated tool calls add cost and latency. Indexing external content also creates retention and deletion obligations; querying it live instead introduces source-system latency and outages. Set a latency budget, cap tool calls, test failure behavior and choose which data to index only after those trade-offs are explicit.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our RAG Development Services practice, or Estimate My RAG System.
