--- title: Elastic Search V8 slug: connectors/elastic-search-v8 docTags: createdAt: 2026-06-09T16:30:17.237Z --- ## Elastic Elasticsearch 8 Elastic Search V8 is a distributed search and analytics engine that enables efficient data storage, search, and analysis. Elastic Search V8 is a powerful search and analytics engine that enables users to store, search, and analyze large volumes of data quickly and in near real-time. The Elastic Search V8 connector for Swimlane Turbine allows users to seamlessly integrate and automate various search operations, such as adding, deleting, and updating documents, as well as executing complex search queries. This integration empowers Swimlane Turbine end-users to enhance their security automation workflows by leveraging Elastic Search's robust capabilities, ensuring efficient data management and rapid response to security incidents. ## Prerequisites Before you can use the Elastic Search V8 connector for Turbine, you'll need access to the Elastic Search API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for your Elastic Search instance. - API Key: A valid API key for authenticating requests. - or Elasticsearch API key authentication using the following parameters: - URL: The endpoint URL for your Elastic Search instance. - API Key: A valid Elasticsearch API key for secure access. - or HTTP Basic authentication using the following parameters: - URL: The endpoint URL for your Elastic Search instance. - Username: Your Elastic Search username for authentication. - Password: Your Elastic Search password for authentication. ## API Key Authentication API key authentication is widely used in organizations and is recommended for production and automation. Use the **API Key Authentication** asset with: - **URL**: The endpoint URL for your Elastic Search 8 instance. - **API Key**: Your Elasticsearch API key. Create one via the [Create API Key API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html) (POST `/_security/api_key`). The key is sent as `Authorization: ApiKey `. ### HTTP Basic Authentication Use the **HTTP Basic Authentication** asset with: - **URL**: The endpoint URL for your Elastic Search 8 instance. - **Username**: Your Elastic Search 8 username credential. - **Password**: Your Elastic Search 8 password credential. ## Search action If the Elasticsearch security features are enabled, you must have the read [index privilege](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-indices) for the target data stream, index, or alias. For cross-cluster search, see [Configure privileges for cross-cluster search](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-privileges.html#remote-clusters-privileges-ccs). To search a [point in time (PIT)](https://www.elastic.co/guide/en/elasticsearch/reference/current/point-in-time-api.html) for an alias, you must have the read index privilege for the alias’s data streams or indices. ### Add document action If the Elasticsearch security features are enabled, you must have the `create_doc`, `create`, `index`, or `write` [index privilege](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-indices). ## Capabilities This connector provides the following capabilities: - Search data stored in Elasticsearch indices and data streams. - Add a JSON document to the specified data stream or index - Delete a JSON document by index and ID - Update By Query API ## Actions Setup ### Add Document Please see the [time units convention](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) if you want to use the `timeout` configuration. ## Notes - [Index API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html) - [Search API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search.html) - [Time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) - [index privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-indices) - [Configure privileges for cross-cluster search](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-privileges.html#remote-clusters-privileges-ccs) - [Point in Time (PIT)](https://www.elastic.co/guide/en/elasticsearch/reference/current/point-in-time-api.html) This connector was last tested against product version: 8.2.2 ## Additional Documentation - [Elastic Search V8 Connector Documentation](https://docs.swimlane.com/connectors/elastic-search-v8) - [Elastic Search V8 API Documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html) # Configurations ## Elastic Search API Key Authentication Authenticates using an Elasticsearch API key. Recommended for production and automation; widely used in organizations. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | api\_key | Elasticsearch API key sent as Authorization: ApiKey
:::Iframe{code=""} :::
. Use the value from the Create API Key API (POST /\_security/api\_key) "api\_key" field, or the base64-encoded "id\:key" form. If your platform sends the value as-is, enter "ApiKey " followed by your key. | | | | string | Required | | | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | apikey | API Key for the Elastic Search V8 instance. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Document Add or update a document in Elastic Search V8 index using 'index', 'id', and 'data' to ensure it is searchable. ### Endpoint - **URL:** `/{{index}}/_doc/{{id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.if_seq_no` | string | Optional | Only perform the operation if the document has this sequence number. | | `parameters.if_primary_term` | string | Optional | Only perform the operation if the document has this primary term. | | `parameters.op_type` | string | Optional | Set to create to only index the document if it does not already exist. | | `parameters.pipeline` | string | Optional | ID of the pipeline to use to preprocess incoming documents. | | `parameters.refresh` | string | Optional | If true, Elasticsearch refreshes the affected shards to make this operation visible to search, if wait\_for then wait for a refresh to make this operation visible to search, if false do nothing with refreshes. | | `parameters.routing` | string | Optional | Custom value used to route operations to a specific shard. | | `parameters.timeout` | string | Optional | Defaults to 1m (one minute). This guarantees Elasticsearch waits for at least the timeout before failing. | | `parameters.version` | string | Optional | Explicit version number for concurrency control. The specified version must match the current version of the document for the request to succeed. | | `parameters.version_type` | string | Optional | Specific version type such as external, external\_gte. | | `parameters.wait_for_active_shards` | string | Optional | The number of shard copies that must be active before proceeding with the operation. Set to all or any positive integer up to the total number of shards in the index (number\_of\_replicas+1) | | `parameters.require_alias` | string | Optional | If true, the destination must be an index alias | | `path_parameters.index` | string | Required | Parameters for the Add Document action | | `path_parameters.id` | string | Required | Parameters for the Add Document action | | `data` | object | Optional | Data | ### Input Example `{"path_parameters":{"index":"metrics-endpoint.metadata_current_default"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_index` | string | Output field: \_index | | `_id` | string | Unique identifier | | `_version` | number | Output field: \_version | | `result` | string | Result of the operation | | `_shards` | object | Output field: \_shards | | `_shards.total` | number | Output field: \_shards.total | | `_shards.successful` | number | Whether the operation was successful | | `_shards.failed` | number | Output field: \_shards.failed | | `_seq_no` | number | Output field: \_seq\_no | | `_primary_term` | number | Output field: \_primary\_term | ### Output Example `{"status_code":201,"response_headers":{"Location":"/metrics-endpoint.metadata_current_default/_doc/ov7ioIQBIpFZuOwYQfZK","X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"195"},"reason":"Created","json_body":{"_index":"metrics-endpoint.metadata_current_default","_id":"ov7ioIQBIpFZuOwYQfZK","_version":1,"result":"created","_shards":{"total":1,"successful":1,"failed":0},"_seq_no":627,"_primary_term":7}}` ## Delete Document Remove a specified JSON document from an Elastic Search V8 index using the provided index and document ID. ### Endpoint - **URL:** `/{{index}}/_doc/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.if_seq_no` | string | Optional | Only perform the operation if the document has this sequence number | | `parameters.if_primary_term` | string | Optional | Only perform the operation if the document has this primary term | | `parameters.refresh` | string | Optional | If true, Elasticsearch refreshes the affected shards to make this operation visible to search, if wait\_for then wait for a refresh to make this operation visible to search, if false do nothing with refreshes. | | `parameters.routing` | string | Optional | Custom value used to route operations to a specific shard | | `parameters.timeout` | string | Optional | Period to wait for active shards. Defaults to 1m (one minute) | | `parameters.version` | string | Optional | Explicit version number for concurrency control. The specified version must match the current version of the document for the request to succeed | | `parameters.version_type` | string | Optional | Specific version type | | `parameters.wait_for_active_shards` | string | Optional | The number of shard copies that must be active before proceeding with the operation | | `path_parameters.index` | string | Required | Name of the target index | | `path_parameters.id` | string | Required | Parameters for the Delete Document action | ### Input Example `{"path_parameters":{"index":"metrics-endpoint.metadata_current_default"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `_index` | string | Output field: \_index | | `_id` | string | Unique identifier | | `_version` | number | Output field: \_version | | `result` | string | Result of the operation | | `_shards` | object | Output field: \_shards | | `_shards.total` | number | Output field: \_shards.total | | `_shards.successful` | number | Whether the operation was successful | | `_shards.failed` | number | Output field: \_shards.failed | | `_seq_no` | number | Output field: \_seq\_no | | `_primary_term` | number | Output field: \_primary\_term | ### Output Example `{"status_code":200,"response_headers":{"X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"195"},"reason":"OK","json_body":{"_index":"metrics-endpoint.metadata_current_default","_id":"ov7ioIQBIpFZuOwYQfZK","_version":2,"result":"deleted","_shards":{"total":1,"successful":1,"failed":0},"_seq_no":628,"_primary_term":7}}` ## Search Execute a search query on a specified index in Elastic Search V8 and return matching hits. Requires path parameters and JSON body. ### Endpoint - **URL:** `/{{index}}/_search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.size` | string | Optional | Defines the number of records to return. | | `parameters.return_observables` | boolean | Optional | When true, each hit is returned as \{alert: \, observables: \} in hits.hits. | | `parameters.search_after_pagination` | boolean | Optional | When true, automatically paginates through all results using search\_after. Requires a sort to be defined in json\_body. All hits across all pages are returned in hits.hits. | | `parameters.page_size` | integer | Optional | Number of hits per page when search\_after\_pagination is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each hit before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | | `path_parameters.index` | string | Required | Parameters for the Search action | | `query` | object | Optional | Query object. Defines the search definition using the Query DSL | | `sort` | array | Optional | Array of sort fields. Required when search\_after\_pagination is true. Use a tiebreaker field (e.g. \_id) to guarantee a stable cursor. | ### Input Example `{"path_parameters":{"index":"my-index-000001"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `_shards` | object | Output field: \_shards | | `_shards.total` | number | Output field: \_shards.total | | `_shards.successful` | number | Whether the operation was successful | | `_shards.skipped` | number | Output field: \_shards.skipped | | `_shards.failed` | number | Output field: \_shards.failed | | `hits` | object | Output field: hits | | `hits.total` | object | Output field: hits.total | | `hits.total.value` | number | Value for the parameter | | `hits.total.relation` | string | Output field: hits.total.relation | | `hits.max_score` | number | Score value | | `hits.hits` | array | Output field: hits.hits | | `hits.hits._index` | string | Output field: hits.hits.\_index | | `hits.hits._id` | string | Unique identifier | | `hits.hits._score` | number | Score value | | `hits.hits._source` | object | Output field: hits.hits.\_source | | `hits.hits._source.container` | object | Output field: hits.hits.\_source.container | | `hits.hits._source.container.id` | string | Unique identifier | | `hits.hits._source.agent` | object | Output field: hits.hits.\_source.agent | | `hits.hits._source.agent.name` | string | Name of the resource | | `hits.hits._source.agent.id` | string | Unique identifier | | `hits.hits._source.agent.ephemeral_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"14790"},"reason":"OK","json_body":{"took":2262,"timed_out":false,"_shards":{"total":228,"successful":228,"skipped":0,"failed":0},"hits":{"total":{},"max_score":1,"hits":[]}}}` ## Update By Query Apply updates to Elastic Search V8 documents using a query or to all if no query is specified, ideal for mapping changes. Requires target path parameter. ### Endpoint - **URL:** `/{{target}}/_update_by_query` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.target` | string | Required | Target specifies the comma-separated list of data streams, indices, and aliases to search within. This parameter supports wildcards (\*). If omitted, or if the value is set to \* or \_all, the search will include all data streams and indices. | | `parameters.allow_no_indices` | boolean | Optional | If set to false, the request returns an error if any wildcard expression, index alias, or \_all value targets only missing or closed indices, even if other open indices are targeted. For example, a request targeting foo\*,bar\* returns an error if no index starts with bar, even if an index starts with foo. | | `parameters.analyzer` | string | Optional | This parameter can only be used when the q query string parameter is specified. | | `parameters.analyze_wildcard` | boolean | Optional | This parameter can only be used when the q query string parameter is specified. | | `parameters.conflicts` | string | Optional | What to do if update by query hits version conflicts are abort or proceed. | | `parameters.default_operator` | string | Optional | This parameter can only be used when the q query string parameter is specified. | | `parameters.df` | string | Optional | This parameter can only be used when the q query string parameter is specified. | | `parameters.expand_wildcards` | string | Optional | Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. | | `parameters.ignore_unavailable` | boolean | Optional | If false, the request returns an error if it targets a missing or closed index. | | `parameters.lenient` | boolean | Optional | If true, format-based query failures (such as providing text to a numeric field) in the query string will be ignored. Defaults to false. | | `parameters.max_docs` | number | Optional | Maximum number of documents to process. | | `parameters.pipeline` | string | Optional | ID of the pipeline to use to preprocess incoming documents. | | `parameters.preference` | string | Optional | Specifies the node or shard the operation should be performed on. | | `parameters.q` | string | Optional | Query in the Lucene query string syntax. | | `parameters.request_cache` | boolean | Optional | If true, the request cache is used for this request. | | `parameters.refresh` | boolean | Optional | If true, Elasticsearch refreshes affected shards to make the operation visible to search. | | `parameters.requests_per_second` | number | Optional | The throttle for this request in sub-requests per second. | | `parameters.routing` | string | Optional | Custom value used to route operations to a specific shard. | | `parameters.scroll` | string | Optional | Period to retain the search context for scrolling. | | `parameters.scroll_size` | number | Optional | Size of the scroll request that powers the operation. | | `parameters.search_type` | string | Optional | The type of the search operation. | | `parameters.search_timeout` | string | Optional | Explicit timeout for each search request. | | `parameters.slices` | number | Optional | The number of slices this task should be divided into. | | `parameters.sort` | string | Optional | A comma-separated list of
:::Iframe{code=""} :::
:
:::Iframe{code=""} :::
pairs. | | `parameters.stats` | string | Optional | Specific tag of the request for logging and statistical purposes. | ### Input Example `{"parameters":{"allow_no_indices":false,"analyzer":"standard","analyze_wildcard":true,"conflicts":"abort","default_operator":"OR","df":"","expand_wildcards":"open","ignore_unavailable":false,"lenient":true,"max_docs":3,"pipeline":"","preference":"","q":"","request_cache":true,"refresh":true,"requests_per_second":-1,"routing":"","scroll":"2d","scroll_size":1000,"search_type":"query_then_fetch","search_timeout":"2d","slices":7,"sort":"","stats":"","terminate_after":3,"timeout":"2d","version":true,"wait_for_active_shards":""},"path_parameters":{"target":"my-index-000001"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `total` | number | Output field: total | | `updated` | number | Output field: updated | | `deleted` | number | Output field: deleted | | `batches` | number | Output field: batches | | `version_conflicts` | number | Output field: version\_conflicts | | `noops` | number | Output field: noops | | `retries` | object | Output field: retries | | `retries.bulk` | number | Output field: retries.bulk | | `retries.search` | number | Output field: retries.search | | `throttled_millis` | number | Output field: throttled\_millis | | `requests_per_second` | number | Output field: requests\_per\_second | | `throttled_until_millis` | number | Output field: throttled\_until\_millis | | `failures` | array | Output field: failures | | `failures.file_name` | string | Name of the resource | | `failures.file` | string | Output field: failures.file | ### Output Example `{"status_code":200,"response_headers":{"Content-Encoding":"gzip","Content-Length":"182","Content-Type":"application/json","X-Cloud-Request-Id":"tYt6P0gXQbijizQhV9_-eA","X-Elastic-Product":"Elasticsearch","X-Found-Handling-Cluster":"b4bc43b5ef0e44a4bc0181e4471683be","X-Found-Handling-Instance":"instance-0000000001","Date":"Mon, 03 Jun 2024 10:35:31 GMT"},"reason":"OK","json_body":{"took":1588,"timed_out":false,"total":14207,"updated":14207,"deleted":0,"batches":15,"version_conflicts":0,"noops":0,...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | ----------------------------------------------------------------------- | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 182 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 03 Jun 2024 10:35:31 GMT | | Location | The URL to redirect a page to | /metrics-endpoint.metadata\_current\_default/\_doc/ov7ioIQBIpFZuOwYQfZK | | X-Cloud-Request-Id | HTTP response header: X-Cloud-Request-Id | tYt6P0gXQbijizQhV9\_-eA | | X-elastic-product | HTTP response header: X-elastic-product | Elasticsearch | | X-Found-Handling-Cluster | HTTP response header: X-Found-Handling-Cluster | b4bc43b5ef0e44a4bc0181e4471683be | | X-Found-Handling-Instance | HTTP response header: X-Found-Handling-Instance | instance-0000000001 |