import { BaseSIEMConnector } from './connector.js';
import type { SecurityEvent, SendResult, ElasticConnectorConfig } from './types.js';
/**
 * Elasticsearch connector for SIEM integration
 *
 * Features:
 * - Bulk API for efficient ingestion
 * - ECS (Elastic Common Schema) compliant
 * - Multiple authentication methods
 * - Connection pooling via node selection
 */
export declare class ElasticConnector extends BaseSIEMConnector {
    readonly type = "elastic";
    private readonly nodes;
    private readonly auth;
    private readonly apiKey?;
    private readonly username?;
    private readonly password?;
    private readonly bearerToken?;
    private readonly index;
    private readonly pipeline?;
    private readonly verifySsl;
    private readonly refresh?;
    private currentNodeIndex;
    constructor(config: ElasticConnectorConfig);
    /**
     * Connect to Elasticsearch cluster
     */
    protected doConnect(): Promise<void>;
    /**
     * Disconnect from Elasticsearch (no-op for HTTP)
     */
    protected doDisconnect(): Promise<void>;
    /**
     * Send events using Bulk API
     */
    protected doSend(events: SecurityEvent[]): Promise<SendResult>;
    /**
     * Send a bulk request to Elasticsearch
     */
    private sendBulk;
    /**
     * Health check - verify cluster is accessible
     */
    protected doHealthCheck(): Promise<boolean>;
    /**
     * Ensure index template exists
     */
    private ensureIndexTemplate;
    /**
     * Convert security event to ECS document
     */
    private toECSDocument;
    /**
     * Resolve index name (supports date patterns)
     */
    private resolveIndex;
    /**
     * Get current node URL with round-robin
     */
    private getNode;
    /**
     * Get authentication headers
     */
    private getAuthHeaders;
}
/**
 * Create an Elasticsearch connector
 */
export declare function createElasticConnector(config: ElasticConnectorConfig): ElasticConnector;
//# sourceMappingURL=elastic.d.ts.map