> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Elasticsearch

> Reference for the Tracecat Elasticsearch integration: registered actions, required secrets, expected inputs, and example workflow usage.

## List indexes

Action ID: `tools.elasticsearch.list_indexes`

List all indexes in the Elasticsearch cluster.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search events

Action ID: `tools.elasticsearch.search_events`

Search events from Elasticsearch using query DSL.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="query" type="object" required>
  Elasticsearch query DSL.
</ParamField>

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Index name to search. If not specified, searches all indices.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of events to return.

  Default: `100`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>