AI-augmented workflows

Workflows and Elastic Agent Builder are complementary. Workflows give you deterministic, auditable, event-driven automation: the steps always run in the same order and produce the same kind of result. Elastic Agent Builder agents give you reasoning: the ability to interpret unstructured context, classify signals, and generate natural-language summaries. Combining the two lets you build automation that's both reliable and intelligent.

The integration runs in both directions: a workflow can call an agent as a step, and an agent can trigger a workflow as a tool.

• Stack 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Create a workflow using natural language. Describe the automation in the Workflows app or in Agent Chat and review the generated YAML before you save. Refer to Author workflows with natural language and Create skills and workflows in chat.
• Call an agent from a workflow. Use the ai.agent step to invoke any agent built in Elastic Agent Builder. The agent sees the workflow's data through template variables, performs its reasoning, and returns a response that subsequent steps can act on. Refer to Call Elastic Agent Builder agents from Elastic Workflows for the full ai.agent reference and examples.
• Trigger a workflow from an agent. Create a workflow tool in Elastic Agent Builder and assign it to an agent. The agent can then invoke the workflow from a conversation, extracting the needed inputs from the user's message and surfacing the workflow's output in chat.
• Classify and route with AI. Pair ai.classify with switch to send each alert, ticket, or signal down a different branch based on a model's categorization.
• Summarize evidence before action. Use ai.summarize to turn gathered evidence into a concise summary for a case description, notification body, or reviewer prompt.
• Gate AI decisions on human review. Pair AI classification with human-in-the-loop to show the model's output to an analyst before the workflow takes action.
• Send structured prompts to an LLM. Use the ai.prompt step with any configured AI connector to run classification, extraction, or summarization without going through an agent.
• Compose reusable AI building blocks. Extract repeated AI step sequences into a child workflow that parent workflows invoke with workflow.execute.

• Use agent-from-workflow when the workflow already knows what it's doing and needs AI only to reason over a specific data set. For example, summarizing an alert, classifying severity, or extracting fields from unstructured text.
• Use workflow-from-agent when the user (or another agent) is in a conversation and wants to trigger a deterministic procedure. For example, isolating a host, opening a case, or running a set of enrichment queries.

Step-by-step guides for AI-augmented workflows:

• Classify and route mixed items with AI: Use ai.classify with foreach and if to send each item down a different branch based on a model's categorization, and summarize with ai.summarize.

• Author workflows with natural language: Create and edit workflows from a plain-language description.
• AI steps reference: ai.prompt, ai.classify, ai.summarize, and ai.agent parameters and output structure.
• Composition steps: Invoke child workflows and emit outputs.
• Human-in-the-loop: Pause a workflow for reviewer input.
• Call Elastic Agent Builder agents from Elastic Workflows: End-to-end guide for invoking agents from workflow steps.
• Workflow tools in Elastic Agent Builder: Configure an agent to trigger a workflow.
• Elastic Agent Builder overview: Concepts, tools, and agent types.