Observability workflows

Observability signals (infrastructure metrics, application logs, traces, and anomaly detection results) generate the same kind of "observe a problem, do something about it" loop that security does. Use workflows to close that loop: correlate signals across sources, route to the right team, and run scheduled maintenance or reporting tasks.

The following patterns use existing workflow capabilities:

• Respond to anomaly detection alerts. Configure an alert trigger on an anomaly detection rule. The workflow runs with the alert's context, and can query log data in a window around the anomaly, enrich with host or service metadata, and open a case or post a notification.
• Correlate signals across data sources. Use Elasticsearch search actions to query metrics, logs, and traces in the same workflow, then combine results with if steps to decide on next actions. Use data action steps to filter, group, and remove duplicate results before acting on them.
• Automate scheduled data operations. Use a scheduled trigger to run periodic health checks, index rollover tasks, or data quality audits.
• Analyze signals with AI. Use AI steps to summarize a multi-signal investigation with ai.summarize, classify anomaly shapes with ai.classify, or invoke an Elastic Agent Builder agent with ai.agent before the workflow takes action.
• Operate on Observability Streams. Use Streams action steps to list available streams and pull significant events into a workflow for further processing.

Step-by-step guides for observability workflows:

• Automate root cause analysis for an observability alert: Run an Elastic Agent Builder agent on an alert, then open a case populated with the agent-generated analysis and reasoning trace.

• Alert triggers: Use anomaly detection or alerting rules to invoke a workflow.
• Scheduled triggers: Run a workflow on a fixed schedule.
• Event-driven triggers: React when another workflow fails.
• Elasticsearch action steps: Reference for search, index, and request actions.
• Streams action steps: Observability Streams operations (technical preview).
• Data action steps: Filter, aggregate, and transform signal data inside a workflow.
• Elastic Agent Builder for Observability: How Agent Builder integrates with observability workflows.