You can secure external Elasticsearch, one of the components in an API Management setup, to communicate securely over HTTPS. To secure external Elasticsearch, you can use the following security plugins:

Both the plugins offer encryption, authentication, and authorization to protect data from attackers and other misuses. The plugins secure external Elasticsearch by exposing it over HTTPS, and enables basic authentication by configuring users.