Type to search.

Choose the right step

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack 9.4+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.4

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Workflows ship with many step types. This page is keyed by intent: find the row that matches what you're trying to do; the right column gives you the step you need and links to its reference.

For an alphabetical catalog of every step type, refer to the Step type index.

Intent Step
Run a Query DSL search elasticsearch.search
Run an ES|QL query elasticsearch.esql.query
Index one document elasticsearch.index
Index many documents efficiently elasticsearch.bulk
Update a document elasticsearch.update
Create, delete, or check an index elasticsearch.indices.create, elasticsearch.indices.delete, elasticsearch.indices.exists
Call an Elasticsearch API not listed above elasticsearch.request
Intent Step
Create a case cases.createCase
Look up a case cases.getCase, cases.findCases, cases.getCasesByAlertId
Change status, severity, or tags cases.updateCase or the field-specific set* steps
Attach alerts or observables cases.addAlerts, cases.addObservables
Attach comments, alerts, dashboards, and more cases.addAttachments The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.
Add a comment cases.addComment
Close the case cases.closeCase
Assign or unassign cases.assignCase, cases.unassignCase

The kibana.* case steps (kibana.createCase, kibana.getCase, kibana.updateCase, kibana.addCaseComment) are deprecated. Use the cases.* replacements. Refer to Migrate workflows from 9.3 to 9.4.

Intent Step
Change alert status (open, closed, acknowledged, in-progress) kibana.SetAlertsStatus (PascalCase)
Add or remove tags on alerts kibana.SetAlertTags (PascalCase)
Intent Step
There's a dedicated Kibana connector (Slack, Jira, PagerDuty, and so on) The connector's named step, for example slack.postMessage.
No dedicated connector, credentials matter http with a configured HTTP connector for secrets storage.
No dedicated connector, quick one-off http without a connector-id.
Intent Step
Conditional branch if
Multi-way dispatch on a value switch
Iterate over an array foreach
Loop until a condition is false while
Run independent work at the same time and use the results parallel The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.
Fan out to independent executions workflow.executeAsync
Exit or skip a loop iteration loop.break, loop.continue
Small conditional on a single step Step-level if: field. Refer to the Steps overview.
Intent Step
Fixed-duration pause wait
Pause for human input waitForInput. Refer to Human-in-the-loop.
Pause for approve/reject waitForApproval The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. . Refer to Human-in-the-loop.
Intent Step
Set a named variable data.set
Map each element of an array to a new shape data.map
Keep only matching elements data.filter
Find the first matching element data.find
Group and aggregate data.aggregate
Concatenate arrays data.concat
Remove duplicates data.dedupe
Parse or serialize JSON data.parseJson, data.stringifyJson
Extract or replace through regex data.regexExtract, data.regexReplace
A small inline transform Liquid templating, no step needed
Intent Step
General prompt, optionally with structured output ai.prompt
Classify into a fixed category set ai.classify
Summarize content ai.summarize
Invoke an Elastic Agent Builder agent ai.agent

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Planned

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Planned

    We plan to add this functionality in a future Elastic Stack update. Subject to changes.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Intent Step
Start a conversation without sending a message The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. ai.conversation.create
Add a note or a user message without an agent response ai.conversation.add_event, ai.conversation.add_user_message
Give the agent extra context, such as a runbook or a dashboard ai.attachment.add
Revise context you already added ai.attachment.update
Remove context you added ai.attachment.delete
Check what's attached, or read an attachment's content ai.attachment.list, ai.attachment.read
Branch on a conversation's status or another metadata field ai.conversation.metadata.read
Record an outcome on the conversation, such as closing an investigation ai.conversation.metadata.patch
Intent Step
Synchronous: parent waits for the child's result workflow.execute The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Fire-and-forget workflow.executeAsync The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Emit outputs from a child workflow workflow.output The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Explicitly terminate a workflow as failed workflow.fail The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Intent Step
Log a message to the execution view console
Understand what a step produced mid-run Inspect the step's output in the execution view. Refer to Monitor workflow execution.
Log only when running a test console with a step-level if: "execution.isTestRun"

Browse the Step type index for an A-to-Z list, or use the YAML editor's autocomplete in Kibana. The autocomplete surfaces every step type with its description as you type.