Elasticsearch

Reference for the Tracecat Elasticsearch integration: registered actions, required secrets, expected inputs, and example workflow usage.

List indexes

Action ID: tools.elasticsearch.list_indexes

List all indexes in the Elasticsearch cluster.

Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices

Secrets

Required secrets:

• elasticsearch: required values ELASTIC_API_KEY.

Input fields

base_url · string | null

Elasticsearch base URL (e.g. https://localhost:9200).

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Search events

Action ID: tools.elasticsearch.search_events

Search events from Elasticsearch using query DSL.

Reference: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search

Secrets

Required secrets:

• elasticsearch: required values ELASTIC_API_KEY.

Input fields

query · object · required

Elasticsearch query DSL.

base_url · string | null

Elasticsearch base URL (e.g. https://localhost:9200).

Default: null.

index · string | null

Index name to search. If not specified, searches all indices.

Default: null.

limit · integer

Maximum number of events to return.

Default: 100.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.