Elasticsearch

Type ID: elasticsearch  ·  Kind: Action  ·  Ports: 1 in, 1 out

Search and partially update documents in an Elasticsearch or OpenSearch cluster.

Credentials

elasticsearch (host, username, password, verify SSL)

Resources & operations

• Document (document)
  • Search (search) - Search documents with Query DSL
  • Update Document (updateDocument) - Partially update a document by index and id

Properties

Common

Property	Key	Type	Required	Default	Possible values	Applies when
Resource	resource	options	Yes	document	Document (document)	-
Operation	operation	options	Yes	search	Search (search), Update Document (updateDocument)	resource = document

Document → Search

Property	Key	Type	Required	Default	Possible values	Applies when
Index	index	string	Yes	''	Index name or pattern, e.g. logs-* or wazuh-alerts-*	resource = document, operation = search
Query	query	json	Yes	{}	Elasticsearch Query DSL - a query object or a full search body	resource = document, operation = search
Size	size	number	No	1	Maximum number of hits to return	resource = document, operation = search
Sort	sort	json	No	[]	Optional sort clause, e.g. [{ "@timestamp": "desc" }]	resource = document, operation = search
Retry On Empty Hits	retryOnEmptyHits	boolean	No	false	Retry the search when no documents are indexed yet	resource = document, operation = search
Retry Delays (seconds)	retryDelaysSec	array	No	[1, 5, 10, 15]	Seconds to sleep between empty-hit retries	resource = document, operation = search, retryOnEmptyHits = true

Document → Update Document

Property	Key	Type	Required	Default	Possible values	Applies when
Index	index	string	Yes	''	Exact index of the document to update	resource = document, operation = updateDocument
Document ID	id	string	Yes	''	Elasticsearch/OpenSearch document _id	resource = document, operation = updateDocument
Fields	fields	json	Yes	{}	Fields to merge into the document via POST /_update	resource = document, operation = updateDocument

Notes

• If Retry On Empty Hits is on, the node retries on the configured delays until it gets a hit, then throws if still empty.
• Search output: { index, doc_id, source, hits, raw }, from the first hit.
• Update Document output: the raw Elasticsearch _update response.
• query, sort, and fields accept a JSON string or a native object/array.