Steps

Workflow steps are the fundamental building blocks of automation. Each step represents a single unit of logic, action, transformation, or reasoning. Together, they define how a workflow operates and what outcomes it can produce. Steps are chained together to move data, coordinate logic, and drive results.

Workflow steps are grouped into the following categories based on their function within the automation.

Action steps carry out operations in internal or external systems. They produce real-world outcomes by performing tasks such as:

• Interact with Elastic features across solutions, including common operations like:
  • Querying data from Elasticsearch or data streams
  • Indexing new documents or updating existing fields
  • Creating or updating cases
  • Changing detection alert status or tags
  • Modifying dashboards or saved objects
• Trigger actions in external systems using APIs, integrations, or service connectors
• Send messages, alerts, or notifications to systems such as Slack or email
• Invoke other workflows

These actions are available as pre-built operations, so you don't need to configure API endpoints or manage authentication details. You select the action you want to perform and provide the required parameters.

Refer to Action steps for the complete action-step catalog.

Flow control steps define how a workflow runs. They control the order, structure, and branching logic of execution. This includes:

• Conditional logic (if, switch): Run different steps based on values and predicates.
• Loops and iteration (foreach, while): Process collections or repeat until a condition changes.
• Loop control (loop.break, loop.continue): Exit early or skip to the next iteration.
• Stack Preview 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Preview Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Concurrency (parallel): Run independent branches at the same time and collect their results.
• Pauses and waits (wait, waitForInput): Introduce timed pauses or pause for human input.

These steps make workflows dynamic and responsive, allowing them to adapt in real time to data and conditions.

Refer to Flow control steps for more information.

AI steps introduce reasoning and language understanding into workflows. Use them to process natural language, classify inputs, summarize content, or operate through agents:

• Send prompts to a generative AI connector with ai.prompt, optionally returning structured output.
• Classify inputs into a fixed category set with ai.classify.
• Summarize content with ai.summarize.
• Invoke an Elastic Agent Builder agent as a step with ai.agent.
• Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Manage the attachments and metadata of Elastic Agent Builder conversations.

Refer to AI steps for the complete AI-step catalog.

In addition to calling agents from workflows, agents built with Elastic Agent Builder can also trigger workflows. To enable this, create a custom workflow tool type and assign it to an agent. The agent can then trigger the workflow from a conversation.

Refer to Workflow tools in Elastic Agent Builder and Connect Elastic Agent Builder agents and Elastic Workflows for more information.

Data action steps transform data between other workflow steps. Use them for filtering, mapping, grouping, JSON parsing, regex extraction, and deduplication: anything that would be brittle or hard to read as inline Liquid.

Refer to Data action steps for the complete data-step catalog.

Composition steps let one workflow call another. A parent workflow can invoke a child synchronously (and use its output) or asynchronously (fire and forget). Use composition for reusable building blocks and fan-out patterns.

Refer to Composition steps for the complete composition-step catalog.