Run a Worker on demand
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Preview
Preview
Stack
Planned
Planned
A Worker normally runs on its own schedule. You can also start a run yourself, for example to see the effect of a settings change without waiting for the next scheduled run. You start the run from the Workflows page, because each Worker is a managed workflow.
- Turn the Worker on. A Worker that's turned off can't be run. Refer to Configure Worker settings > Turn a Worker on or off and view its runs.
- Turn on the Show managed workflows advanced setting. Managed workflows are hidden by default, and the Workflows page can't show a Worker while they're hidden. Refer to Set up Workflows > Show managed workflows.
- Make sure your role includes the privilege to run workflows. Refer to Grant access to AlertZero > Let administrators set up and manage Workers.
A run that you start from the workflow list is an extra run, in addition to the scheduled ones. The Worker still runs on its schedule, and the extra run produces the same kinds of results as a scheduled run, such as proposed actions and investigations.
A run that you start uses the same autonomy level as a scheduled run, with one exception: the Endpoint Analysis Worker. When you run it yourself, it always uses Manual autonomy, even if you set it to Supervised. Any containment proposed actions that it creates wait for your approval.
- Find Workflows in the navigation menu or use the global search field.
- Select View, then select Managed so that managed workflows appear in the list.
- In the workflow list, find the Worker.
- In the Worker's row, select Run .
To check the result of the run, refer to View execution history.
Start the run from the workflow list, not from the workflow editor that View executions opens. A run that you start in the editor is a test run, which is meant for trying out a workflow while you author it, not for production runs. For more information, refer to Use the YAML editor > Test runs and production runs.