Type to search.

Step type index

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack GA 9.4+ …

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.4

    This functionality is generally available and ready for production usage.

  • Preview in 9.3

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Every step type available for Elastic Workflows, ordered alphabetically. Use this lookup when you know the step ID and want the reference fast. If you know what you want to do but not which step to use, refer to Choose the right step.

Step type Category What it does
ai.agent AI Invoke an Elastic Agent Builder agent as a step.
ai.attachment.add The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. AI Add an attachment to an Elastic Agent Builder conversation.
ai.attachment.delete The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. AI Delete an attachment from an Elastic Agent Builder conversation.
ai.attachment.list The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. AI List the attachments in an Elastic Agent Builder conversation.
ai.attachment.read The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. AI Read the content of an attachment in an Elastic Agent Builder conversation.
ai.attachment.update The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. AI Update an attachment in an Elastic Agent Builder conversation.
ai.classify AI Classify input into a fixed category set.
ai.conversation.metadata.patch The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. AI Update the metadata of an Elastic Agent Builder conversation.
ai.conversation.metadata.read The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. AI Read the metadata of an Elastic Agent Builder conversation.
ai.prompt AI Prompt a model, optionally with structured output.
ai.summarize AI Summarize content with an LLM.
cases.addAlerts Cases Attach detection alerts to a case.
cases.addAttachments The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Cases Attach several attachment types to a case in one request.
cases.addComment Cases Add a comment to a case.
cases.addEvents Cases Attach events to a case.
cases.addObservables Cases Add observables (IPs, hashes, domains) to a case.
cases.addTags Cases Add tags to a case.
cases.assignCase Cases Assign a case to one or more users.
cases.closeCase Cases Close a case.
cases.createCase Cases Create a case.
cases.createCaseFromTemplate Cases Create a case from a template.
cases.deleteCases Cases Delete one or more cases.
cases.deleteObservable Cases Delete an observable from a case.
cases.findCases Cases Search for cases.
cases.findSimilarCases Cases Find cases similar to a given case.
cases.getAllAttachments Cases List every attachment on a case.
cases.getCase Cases Fetch a case by ID.
cases.getCases Cases Fetch multiple cases by ID.
cases.getCasesByAlertId Cases Find cases containing a specific alert.
cases.pushCases Cases Push one or more cases to their configured external connector.
cases.removeTags Cases Remove tags from a case.
cases.setCategory Cases Set a case's category.
cases.setCustomField Cases Set a custom field on a case.
cases.setDescription Cases Update a case's description.
cases.setSeverity Cases Set a case's severity.
cases.setStatus Cases Set a case's status.
cases.setTitle Cases Update a case's title.
cases.unassignCase Cases Remove assignees from a case.
cases.updateCase Cases Update one case's fields.
cases.updateCases Cases Bulk update multiple cases.
cases.updateObservable Cases Update an observable.
console HTTP and console Log a message to the workflow execution view.
data.aggregate Data Group and aggregate a collection.
data.concat Data Concatenate arrays.
data.dedupe Data Remove duplicates from an array.
data.filter Data Keep elements matching a KQL predicate.
data.find Data Return the first element matching a KQL predicate.
data.map Data Transform each element of an array.
data.parseJson Data Parse a JSON string into an object.
data.regexExtract Data Extract fields from a string using regex.
data.regexReplace Data Replace regex matches in a string.
data.set Data Set named variables in the workflow context.
data.stringifyJson Data Serialize an object to a JSON string.
elasticsearch.bulk Elasticsearch Bulk index, update, or delete documents.
elasticsearch.esql.query Elasticsearch Run an ES|QL query.
elasticsearch.index Elasticsearch Index one document.
elasticsearch.indices.create Elasticsearch Create an index.
elasticsearch.indices.delete Elasticsearch Delete one or more indices.
elasticsearch.indices.exists Elasticsearch Check whether indices exist.
elasticsearch.request Elasticsearch Generic Elasticsearch API escape hatch.
elasticsearch.search Elasticsearch Run a search.
elasticsearch.update Elasticsearch Update one document.
entityStore.updateAssetCriticality The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Entity store Set or remove an entity's asset criticality, and optionally recalculate its risk score.
foreach Flow control Iterate over a collection.
http HTTP and console Call any external HTTP API.
if Flow control Conditional branching.
kibana.request Kibana Generic Kibana API escape hatch.
kibana.SetAlertsStatus Kibana Update detection alert status. PascalCase.
kibana.SetAlertTags Kibana Add or remove tags on detection alerts. PascalCase.
kibana.streams.get Streams (tech preview) Fetch a stream by name.
kibana.streams.getSignificantEvents Streams (tech preview) Get significant events for a stream.
kibana.streams.list Streams (tech preview) List available streams.
loop.break Flow control Exit the innermost loop.
loop.continue Flow control Skip to the next iteration.
parallel The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Flow control Run branches concurrently and collect a per-branch result.
security.assignAlert Security Assign or unassign users on one or more alerts.
security.assignAttack Security Assign or unassign users on one or more attacks.
security.disableRule The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Security Disable one or more detection rules by rule-ID list or KQL query, with partial-failure reporting.
security.enableRule The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Security Enable one or more detection rules by rule-ID list or KQL query, with partial-failure reporting.
security.setAlertStatus Security Set alert status: open, acknowledged, or closed.
security.setAlertTags Security Add or remove tags on one or more alerts.
security.setAttackStatus Security Set attack status: open, acknowledged, or closed.
security.setAttackTags Security Add or remove tags on one or more attacks.
switch Flow control Multi-way dispatch.
wait Flow control Pause for a fixed duration.
waitForApproval The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Flow control Pause for approve/reject (human-in-the-loop).
waitForInput Flow control Pause for human input (human-in-the-loop).
while Flow control Loop while a condition holds.
workflow.execute Composition (tech preview) Run a child workflow synchronously.
workflow.executeAsync Composition (tech preview) Fire-and-forget child workflow.
workflow.fail Composition (tech preview) Terminate the workflow as failed.
workflow.output Composition (tech preview) Emit the final outputs of a workflow.

In addition to the steps listed previously, every configured Kibana connector exposes one or more <connector>.<action> step types. Common examples include:

  • slack.postMessage — Post a message to a Slack channel.
  • jira.createIssue — Create a Jira issue.
  • pagerduty.triggerIncident — Page an on-call rotation.
  • virustotal.scanFileHash — Scan a file hash.

Because the available connector steps depend on which connectors your deployment has configured, they aren't enumerated here. Refer to the Kibana connectors reference for the full catalog.

Deprecated step types still work in existing workflows but can't be used in new ones. They're hidden from autocomplete and the Add Action menu, and the YAML editor shows a deprecation warning with a replacement suggestion on hover.

Refer to the migration guide for Cases replacement details. For AI connector steps, replace them with ai.prompt (or another AI step such as ai.classify, ai.summarize, or ai.agent when that better matches the task).

Deprecated Replacement
kibana.createCaseDefaultSpace cases.createCase
kibana.getCaseDefaultSpace cases.getCase
kibana.updateCaseDefaultSpace cases.updateCase
kibana.addCaseCommentDefaultSpace cases.addComment
inference.* ai.prompt
bedrock.* ai.prompt
gen-ai.* ai.prompt
gemini.* ai.prompt