Skip to main content

​
Get document

Action ID: tools.elasticsearch.get_document Get an Elasticsearch document by ID. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-get

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Document ID.
​
string
required
Index name.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Get mapping

Action ID: tools.elasticsearch.get_mapping Get mapping definitions for an Elasticsearch index. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-get-mapping

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Index name or pattern.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native Elasticsearch query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
List indexes

Action ID: tools.elasticsearch.list_indexes List indexes in the Elasticsearch cluster as JSON. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Optional index name or pattern to filter the response.Default: null.
​
object | null
Optional native cat indices query parameters. The format parameter is always set to json.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Run EQL query

Action ID: tools.elasticsearch.eql Run an API-native Event Query Language query for event correlation and threat hunting. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-search

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
string
required
Index, data stream, alias, or comma-separated target pattern to search.
​
object
required
API-native EQL JSON request body, including the query string.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native EQL query parameters.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Run ES|QL query

Action ID: tools.elasticsearch.esql Run an API-native ES|QL query for security investigation and threat hunting. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-query

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
object
required
API-native ES|QL JSON request body, including the query string.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
object | null
Optional native ES|QL query parameters, such as response format.Default: null.
​
boolean
Whether to verify SSL certificates.Default: true.

​
Search events

Action ID: tools.elasticsearch.search_events Search Elasticsearch events with a query DSL body and result limit. Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search

​
Secrets

Required secrets:
  • elasticsearch: required values ELASTIC_API_KEY.

​
Input fields

​
object
required
Elasticsearch query DSL.
​
string | null
Elasticsearch base URL (e.g. https://localhost:9200).Default: null.
​
string | null
Index name to search. If not specified, searches all indices.Default: null.
​
integer
Maximum number of events to return.Default: 100.
​
boolean
Whether to verify SSL certificates.Default: true.