Skip to main content

​
Count documents

Action ID: tools.elasticsearch.count_documents Count documents matching an optional Query DSL query. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-count

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Comma-separated index, data stream, or alias names. Use _all or * for all.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
object | null
Optional JSON request body, e.g. {"query": {...}}.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Delete document

Action ID: tools.elasticsearch.delete_document Delete an Elasticsearch document by ID. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-delete

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Document ID.
​
string
required
Index, data stream, or alias name.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get document

Action ID: tools.elasticsearch.get_document Get an Elasticsearch document by ID. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-get

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Document ID.
​
string
required
Index name.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get field capabilities

Action ID: tools.elasticsearch.get_field_capabilities Get the type and searchable/aggregatable capabilities of fields across indices. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-field-caps

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Comma-separated field names or wildcard patterns (e.g. *).
​
string
required
Comma-separated index, data stream, or alias names. Use _all or * for all.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional JSON request body, e.g. index_filter or runtime_mappings.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get mapping

Action ID: tools.elasticsearch.get_mapping Get mapping definitions for an Elasticsearch index. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-get-mapping

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Index name or pattern.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Index document

Action ID: tools.elasticsearch.index_document Create or replace a document in an Elasticsearch index or data stream. Omit document_id to let Elasticsearch generate one. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-index

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
object
required
The document source as JSON.
​
string
required
Index, data stream, or alias name.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Document ID. Omit to auto-generate.Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
List indexes

Action ID: tools.elasticsearch.list_indexes List indexes in the Elasticsearch cluster as JSON. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Optional index name or pattern to filter the response.Default: null.
​
object | null
Optional native cat indices query parameters. The format parameter is always set to json.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Run EQL query

Action ID: tools.elasticsearch.eql Run an API-native Event Query Language query for event correlation and threat hunting. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-search

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Index, data stream, alias, or comma-separated target pattern to search.
​
object
required
API-native EQL JSON request body, including the query string.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native EQL query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Run ES|QL query

Action ID: tools.elasticsearch.esql Run an API-native ES|QL query for security investigation and threat hunting. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-query

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
object
required
API-native ES|QL JSON request body, including the query string.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native ES|QL query parameters, such as response format.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search events

Action ID: tools.elasticsearch.search_events Search Elasticsearch events with a query DSL body and result limit. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
object
required
Elasticsearch query DSL.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Index name to search. If not specified, searches all indices.Default: null.
​
integer
Maximum number of events to return.Default: 100.
​
boolean
Whether to verify SSL certificates.Default: true.

​
SQL query

Action ID: tools.elasticsearch.sql_query Run an Elasticsearch SQL query. Pass cursor from a previous response to fetch the next page. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-sql-query

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
object
required
API-native JSON request body, e.g. query, fetch_size, filter, params, time_zone, or cursor.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Update document

Action ID: tools.elasticsearch.update_document Partially update an Elasticsearch document by ID (doc), with a script, or as an upsert. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-update

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Document ID.
​
string
required
Index, data stream, or alias name.
​
object
required
API-native JSON request body, e.g. doc (partial document), script, upsert, doc_as_upsert, detect_noop.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.