diff --git a/.changeset/big-rules-nail.md b/.changeset/big-rules-nail.md
new file mode 100644
index 0000000000..959ce2a26e
--- /dev/null
+++ b/.changeset/big-rules-nail.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend-module-elasticsearch': patch
+---
+
+Align the configuration schema with the docs and actual behavior of the code
diff --git a/plugins/search-backend-module-elasticsearch/config.d.ts b/plugins/search-backend-module-elasticsearch/config.d.ts
index 401e55f792..df9852c922 100644
--- a/plugins/search-backend-module-elasticsearch/config.d.ts
+++ b/plugins/search-backend-module-elasticsearch/config.d.ts
@@ -80,165 +80,127 @@ export interface Config {
            */
           rejectUnauthorized?: boolean;
         };
-      } & (
-        | {
-            // elastic = Elastic.co ElasticSearch provider
-            provider: 'elastic';
+      };
+    } & (
+      | {
+          // elastic = Elastic.co ElasticSearch provider
+          provider: 'elastic';
 
-            /**
-             * Elastic.co CloudID
-             * See: https://www.elastic.co/guide/en/elasticsearch/client/javascript-api/current/client-connecting.html#authentication
-             */
-            cloudId: string;
+          /**
+           * Elastic.co CloudID
+           * See: https://www.elastic.co/guide/en/elasticsearch/client/javascript-api/current/client-connecting.html#authentication
+           */
+          cloudId: string;
 
-            auth: {
-              username: string;
-
-              /**
-               * @visibility secret
-               */
-              password: string;
-            };
-          }
-
-        /**
-         *  AWS = Amazon Elasticsearch Service provider
-         *
-         *  Authentication is handled using the default AWS credentials provider chain
-         */
-        | {
-            provider: 'aws';
-
-            /**
-             * Node configuration.
-             * URL AWS ES endpoint to connect to.
-             * Eg. https://my-es-cluster.eu-west-1.es.amazonaws.com
-             */
-            node: string;
-
-            /**
-             * The AWS region.
-             * Only needed if using a custom DNS record.
-             */
-            region?: string;
-
-            /**
-             * The AWS service used for request signature.
-             * Either 'es' for "Managed Clusters" or 'aoss' for "Serverless".
-             * Only needed if using a custom DNS record.
-             */
-            service?: 'es' | 'aoss';
-          }
-
-        /**
-         * Standard ElasticSearch
-         *
-         * Includes self-hosted clusters and others that provide direct connection via an endpoint
-         * and authentication method (see possible authentication options below)
-         */
-        | {
-            /**
-             * Node configuration.
-             * URL/URLS to ElasticSearch node to connect to.
-             * Either direct URL like 'https://localhost:9200' or with credentials like 'https://username:password@localhost:9200'
-             */
-            node: string | string[];
-
-            /**
-             * Authentication credentials for ElasticSearch
-             * If both ApiKey/Bearer token and username+password is provided, tokens take precedence
-             */
-            auth?:
-              | {
-                  username: string;
-
-                  /**
-                   * @visibility secret
-                   */
-                  password: string;
-                }
-              | {
-                  /**
-                   * Base64 Encoded API key to be used to connect to the cluster.
-                   * See: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html
-                   *
-                   * @visibility secret
-                   */
-                  apiKey: string;
-                };
-            /* TODO(kuangp): unsupported until @elastic/elasticsearch@7.14 is released
-    | {
-
-      /**
-       * Bearer authentication token to connect to the cluster.
-       * See: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-service-token.html
-       *
-       * @visibility secret
-       *
-      bearer: string;
-    };*/
-          }
-
-        /**
-         *  AWS = In house hosting Open Search
-         */
-        | {
-            provider: 'opensearch';
-            /**
-             * Node configuration.
-             * URL/URLS to OpenSearch node to connect to.
-             * Either direct URL like 'https://localhost:9200' or with credentials like 'https://username:password@localhost:9200'
-             */
-            node: string | string[];
-
-            /**
-             * Authentication credentials for OpenSearch
-             * If both ApiKey/Bearer token and username+password is provided, tokens take precedence
-             */
-            auth?:
-              | {
-                  username: string;
-
-                  /**
-                   * @visibility secret
-                   */
-                  password: string;
-                }
-              | {
-                  /**
-                   * @visibility secret
-                   */
-                  apiKey: string;
-                };
-          }
-      );
-
-      /**
-       * Authentication credentials for ElasticSearch. These are fallback
-       * credentials - in most cases, for known specific ES implementations, the
-       * respective auth block inside the clientOptions above will be used.
-       *
-       * If both ApiKey/Bearer token and username+password is provided, tokens
-       * take precedence
-       */
-      auth?:
-        | {
+          auth: {
             username: string;
 
             /**
              * @visibility secret
              */
             password: string;
-          }
-        | {
-            /**
-             * Base64 Encoded API key to be used to connect to the cluster.
-             * See: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html
-             *
-             * @visibility secret
-             */
-            apiKey: string;
           };
-    };
+        }
+
+      /**
+       *  AWS = Amazon Elasticsearch Service provider
+       *
+       *  Authentication is handled using the default AWS credentials provider chain
+       */
+      | {
+          provider: 'aws';
+
+          /**
+           * Node configuration.
+           * URL AWS ES endpoint to connect to.
+           * Eg. https://my-es-cluster.eu-west-1.es.amazonaws.com
+           */
+          node: string;
+
+          /**
+           * The AWS region.
+           * Only needed if using a custom DNS record.
+           */
+          region?: string;
+
+          /**
+           * The AWS service used for request signature.
+           * Either 'es' for "Managed Clusters" or 'aoss' for "Serverless".
+           * Only needed if using a custom DNS record.
+           */
+          service?: 'es' | 'aoss';
+        }
+
+      /**
+       * Standard ElasticSearch
+       *
+       * Includes self-hosted clusters and others that provide direct connection via an endpoint
+       * and authentication method (see possible authentication options below)
+       */
+      | {
+          /**
+           * Node configuration.
+           * URL/URLS to ElasticSearch node to connect to.
+           * Either direct URL like 'https://localhost:9200' or with credentials like 'https://username:password@localhost:9200'
+           */
+          node: string | string[];
+
+          /**
+           * Authentication credentials for ElasticSearch
+           * If both ApiKey/Bearer token and username+password is provided, tokens take precedence
+           */
+          auth?:
+            | {
+                username: string;
+
+                /**
+                 * @visibility secret
+                 */
+                password: string;
+              }
+            | {
+                /**
+                 * Base64 Encoded API key to be used to connect to the cluster.
+                 * See: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html
+                 *
+                 * @visibility secret
+                 */
+                apiKey: string;
+              };
+        }
+
+      /**
+       *  AWS = In house hosting Open Search
+       */
+      | {
+          provider: 'opensearch';
+          /**
+           * Node configuration.
+           * URL/URLS to OpenSearch node to connect to.
+           * Either direct URL like 'https://localhost:9200' or with credentials like 'https://username:password@localhost:9200'
+           */
+          node: string | string[];
+
+          /**
+           * Authentication credentials for OpenSearch
+           * If both ApiKey/Bearer token and username+password is provided, tokens take precedence
+           */
+          auth?:
+            | {
+                username: string;
+
+                /**
+                 * @visibility secret
+                 */
+                password: string;
+              }
+            | {
+                /**
+                 * @visibility secret
+                 */
+                apiKey: string;
+              };
+        }
+    );
   };
 }