Test Elastic's leading-edge, out-of-the-box capabilities. Dive into our sample notebooks in the Elasticsearch Labs repo, start a free cloud trial, or try Elastic on your local machine now.
Elastic Workflows is an automation engine built into the Elasticsearch platform. You define workflows in YAML; what triggers (starts) them, what steps they take, what actions they perform, and the platform handles execution. A workflow can query Elasticsearch, transform data, branch based on conditions, call external APIs, and integrate with services like Slack, Jira, PagerDuty and more through connectors you've already configured.
In this blog post, we'll cover the core concepts of Workflows and build an example workflow together.
Workflows are declarative and defined in YAML
Workflows are composable. You define what should happen, and the platform handles execution, error recovery, and logging. Every workflow is defined as YAML and lives inside Kibana.
A workflow is composed of a few key parts: triggers, inputs, and steps.
Triggers determine when a workflow runs. An alert trigger runs when a Kibana alerting rule fires, with full access to the alert context. A scheduled trigger runs on an interval or cron pattern. A manual trigger runs on demand from the UI or API. A workflow can have multiple triggers.
Inputs define parameters that can be passed to the workflow at runtime. These let you create reusable workflows that accept different values depending on how they're invoked.
Steps are the actions a workflow takes. They execute in sequence, and each step can reference outputs from previous steps. Step types include:
- Internal actions for actions you perform inside Elasticsearch and Kibana, like querying indices, running Elasticsearch Query Language (ES|QL) queries, creating cases, or updating alerts.
- External actions for actions you perform on external systems, like sending a Slack message or creating a Jira ticket. Use any connector you've configured in Elastic, with the flexibility to hit any API or internal service using HTTP steps.
- Flow control for defining the logic of your workflow with conditionals, loops, and parallel execution.
- AI for everything from prompting a large language model (LLM) to enabling agents as workflow steps, unlocking agentic workflow use cases.
Getting practical: Your first workflow
Let's build a workflow that demonstrates core capabilities: working with Elasticsearch indices, conditional logic, and data flow between steps. We'll create a simple demo that sets up a National Parks index, loads sample data, and searches it.
Enable Workflows
Workflows is available in Elastic 9.3 (Technical Preview). Go to Stack Management → Advanced Settings, and enable Elastic Workflows: