← All tools
Architecture & Security

How SearchAli Monitoring Works

Everything the extension does, in plain language — including the trade-offs we don’t hide.

Quick answer

SearchAli Monitoring runs entirely in your browser. It connects directly to the Elasticsearch or OpenSearch cluster you configure — there is no backend server in between, no telemetry, and license checks happen fully offline.

Your Browser
SearchAli Monitoring ExtensionGET _cluster/health
GET _cat/nodes
GET _cluster/settings
POST _search
timeout: 30s
max_retry: 3 (only on timeout)
backoff: 500ms → 1000ms
max_concurrent: 4 / cluster
cluster URL, username & password & data — everything is stored in your browser (chrome.storage.local), never sent anywhere else
Your Clusterdirect HTTPS
no proxy
Internet / other serversnever contacted — no telemetry, no third parties
fetch()
response
Every request your browser makes, and the response that comes back — code: src/services/elasticsearch.ts

Architecture: no server in the middle

Most monitoring tools route your cluster traffic through a hosted backend. SearchAli Monitoring doesn’t have one. Every request the extension makes goes straight from your browser to the base URL you typed in — your cluster’s own host and port. All of that traffic is centralized through a single client-side module, kept that way on purpose so it stays auditable.

Where your credentials live

API keys, usernames, and passwords you enter for a cluster connection are stored in chrome.storage.local — the extension’s own local storage inside your browser.

Worth knowing

Chrome does not encrypt this storage by default. Protection against someone else reading it comes from your operating system’s disk encryption (FileVault, BitLocker, etc.), not from the extension. This is normal for browser extensions, but we’d rather say it plainly than let you assume otherwise.

Those credentials are only ever attached to requests sent to the cluster URL you configured. Nothing is copied to a second destination.

What each Chrome permission actually does

The extension requests two things in its manifest. Here is what each one is for — and where it could theoretically be misused, since Chrome’s permission model doesn’t distinguish “used for good” from “capable of.”

storage

Lets the extension remember your cluster connections, settings, and license key locally, so you don’t re-enter them every time you open it.

host_permissions (all_urls)

The broadest permission Chrome offers — and the most honest thing we can say is that nothing in Chrome’s model technically prevents code from calling other hosts with it. It’s requested because clusters can live on any host or port you choose, which isn’t knowable in advance. What actually happens is enforced by keeping every outgoing request in one reviewable file, not by a technical restriction.

Premium license checks are fully offline

A license key is a signed string verified locally with a bundled public key (ECDSA, WebCrypto). There is no server call involved — validation, expiry, and clock checks all happen on your machine. A valid license keeps working without an internet connection until it expires.

No telemetry — with one Chrome-standard exception

There is no analytics or tracking SDK anywhere in the extension. The one thing worth naming: Chrome has a built-in API (setUninstallURL) that opens a short survey page only when you uninstall the extension. Nothing is sent unless you actively fill it in — a reason, optional detail checkboxes, and an optional email address you can leave blank.

Guardrails on the Rest console

The built-in Rest console can run any request against your cluster, including destructive ones. Methods and paths that match known-destructive patterns (DELETE, _forcemerge, _reindex, _delete_by_query, _close, _cluster/reroute) trigger a confirmation step first. That’s a speed bump, not a hard block — as the admin of your own cluster, you can still choose to run it.

Security & privacy — frequently asked

Does any of my cluster data go to searchali.com?
No. The extension talks directly to the cluster URL you configure. searchali.com is only involved when you visit this website — never as part of a monitoring request.
Are my cluster credentials encrypted?
They are stored in chrome.storage.local, which Chrome does not encrypt by default. Your operating system’s disk encryption is what protects them at rest.
Does the extension work without an internet connection?
Yes, for everything except reaching your cluster itself. Premium license validation is fully offline and keeps working until the license expires.
Can the extension delete or modify data on my cluster?
Only if you explicitly run a request that does — for example through the Rest console or a premium action like Fix Allocation. Destructive request types trigger a confirmation dialog first.
Why does the extension need access to all sites?
Because your cluster can be on any host or port. Chrome doesn’t offer a narrower permission for “any host the user later types in.” In practice, the code only ever calls the cluster URL you configured.