> ## Documentation Index
> Fetch the complete documentation index at: https://tracecat-codex-docs-secrets-oauth-discoverability.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Elasticsearch

> Reference for the Tracecat Elasticsearch integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Get document

Action ID: `tools.elasticsearch.get_document`

Get an Elasticsearch document by ID.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-get](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-get)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="document_id" type="string" required>
  Document ID.
</ParamField>

<ParamField path="index" type="string" required>
  Index name.
</ParamField>

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Elasticsearch query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Get mapping

Action ID: `tools.elasticsearch.get_mapping`

Get mapping definitions for an Elasticsearch index.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-get-mapping](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-get-mapping)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="index" type="string" required>
  Index name or pattern.
</ParamField>

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native Elasticsearch query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## List indexes

Action ID: `tools.elasticsearch.list_indexes`

List indexes in the Elasticsearch cluster as JSON.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Optional index name or pattern to filter the response.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native cat indices query parameters. The format parameter is always set to json.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run EQL query

Action ID: `tools.elasticsearch.eql`

Run an API-native Event Query Language query for event correlation and threat hunting.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-search](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-search)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="index" type="string" required>
  Index, data stream, alias, or comma-separated target pattern to search.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native EQL JSON request body, including the query string.
</ParamField>

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native EQL query parameters.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Run ES|QL query

Action ID: `tools.elasticsearch.esql`

Run an API-native ES|QL query for security investigation and threat hunting.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-query](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-query)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native ES|QL JSON request body, including the query string.
</ParamField>

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  Optional native ES|QL query parameters, such as response format.

  Default: `null`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>

## Search events

Action ID: `tools.elasticsearch.search_events`

Search Elasticsearch events with a query DSL body and result limit.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search)

### Secrets

Required secrets:

* `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="query" type="object" required>
  Elasticsearch query DSL.
</ParamField>

<ParamField path="base_url" type="string | null">
  Elasticsearch base URL (e.g. [https://localhost:9200](https://localhost:9200)).

  Default: `null`.
</ParamField>

<ParamField path="index" type="string | null">
  Index name to search. If not specified, searches all indices.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of events to return.

  Default: `100`.
</ParamField>

<ParamField path="verify_ssl" type="boolean">
  Whether to verify SSL certificates.

  Default: `true`.
</ParamField>