Context variables

Context variables are the data you can reference inside Liquid expressions in a workflow. Every execution gets the same core set. Some variables are only populated in certain contexts (for example, foreach.item exists only inside a foreach loop).

This page is the canonical reference. For the mental model and the {{ }} vs. ${{ }} distinction, refer to Templating engine.

Values provided at workflow invocation time. Declared in the workflow's top-level inputs block.

inputs:
  - name: service_name
    type: string
    required: true

steps:
  - name: search
    type: elasticsearch.esql.query
    with:
      query: "FROM logs-* | WHERE service.name == \"{{ inputs.service_name }}\""

Constants declared at the top of the workflow. Evaluated once at workflow load. They can't reference other context (no inputs, no steps).

consts:
  threshold: 70
  slack_channel: "#soc-oncall"

steps:
  - name: notify
    type: slack.postMessage
    with:
      channel: "{{ consts.slack_channel }}"
      text: "Threshold {{ consts.threshold }} exceeded."

The output produced by a previous step. Shape depends on the step type. Refer to each step's reference for what it returns.

steps:
  - name: search
    type: elasticsearch.search
    with: { index: "logs-*", size: 1 }

  - name: summarize
    type: console
    with:
      message: "First hit: {{ steps.search.output.hits.hits[0]._id }}"

Error details if the step failed and its on-failure: continue caught the error. null if the step succeeded. Refer to Pass data and handle errors for the continue strategy.

- name: flaky_call
  type: http
  on-failure:
    continue: true
  with: { url: "https://flaky.example" }

- name: handle
  type: if
  condition: "steps.flaky_call.error : null"
  steps: [ ... ]
  else:  [ ... ]

1. success path
2. failure path (steps.flaky_call.error has detail)

The trigger payload. Shape depends on the trigger type:

For the full workflows.failed payload, refer to Event-driven triggers.

Alert trigger example:

- name: log
  type: console
  with:
    message: |
      Got {{ event.alerts | size }} alerts from rule "{{ event.rule.name }}".
      First host: {{ event.alerts[0].host.name }}

Metadata about the current workflow execution.

execution.triggeredBy values include:

• manual, scheduled, and alert.
• The trigger ID for runs started by an event trigger, such as workflows.failed.
• Serverless Preview Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Stack Preview 9.4+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. workflow-step when a parent workflow starts the run with a workflow.execute or workflow.executeAsync step.
• Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. agent-builder-hook when Elastic Agent Builder starts the workflow as a pre-execution or post-execution workflow.

For how each trigger type determines execution.executedBy, refer to Workflow authorization.

- name: link
  type: console
  with:
    message: "View this execution: {{ execution.url }}"

Metadata about the workflow itself, not the execution.

- name: audit
  type: elasticsearch.index
  with:
    index: "workflow-audit"
    document:
      workflow_id:   "{{ workflow.id }}"
      workflow_name: "{{ workflow.name }}"
      space_id:      "{{ workflow.spaceId }}"
      execution_id:  "{{ execution.id }}"

Available inside a foreach loop body.

- name: process
  foreach: "${{ event.alerts }}"
  steps:
    - name: log
      type: console
      with:
        message: "[{{ foreach.index }}/{{ foreach.total }}] {{ foreach.item._id }}"

Available inside a while loop body. Zero-based iteration counter.

- name: poll
  type: while
  condition: "steps.check.output.status : 'pending'"
  max-iterations: 30
  steps:
    - name: log
      type: console
      with: { message: "Attempt {{ while.iteration }}" }
    - name: check
      type: elasticsearch.search
      with: { index: "jobs", size: 1 }
    - name: wait
      type: wait
      with: { duration: "2s" }

Variables set by one or more data.set steps. Global within the workflow execution. Later data.set steps can overwrite earlier values.

- name: init
  type: data.set
  with:
    service: "checkout"
    region: "us-east"

- name: query
  type: elasticsearch.esql.query
  with:
    query: "FROM logs-{{ variables.region }}-* | WHERE service.name == \"{{ variables.service }}\""

Current timestamp as an ISO 8601 string. Evaluated per reference, so repeated uses in the same expression will match.

- name: index_row
  type: elasticsearch.index
  with:
    index: "events"
    document:
      at: "{{ now }}"
      formatted: "{{ now | date: '%Y-%m-%d %H:%M' }}"

Base URL of the Kibana instance. Useful for building deep links in notifications.

- name: notify
  type: slack.postMessage
  with:
    channel: "#soc"
    text: |
      Case created: <{{ kibanaUrl }}/app/security/cases/{{ steps.create_case.output.case.id }}|Open in {{kib}}>

• Templating engine: How Liquid expressions evaluate these variables.
• Liquid filters: Transformations you can apply to any variable.
• Cheat sheet: The condensed version of this table.
• Steps overview: Each step's reference documents what its output contains.