Elasticsearch V7
Elastic Elasticsearch 7
ElasticSearch V7 is an open-source search and analytics engine that provides fast and scalable data retrieval and analysis.
ElasticSearch V7 is a powerful search and analytics engine that enables users to store, search, and analyze large volumes of data quickly and in near real-time. This connector allows Swimlane Turbine users to automate key ElasticSearch operations such as creating, deleting, and searching documents within indices. By integrating ElasticSearch V7 with Swimlane Turbine, users can enhance their security analytics capabilities, streamline data management, and improve incident response times through automated workflows.
Prerequisites
Before you can use the ElasticSearch V7 connector for Turbine, you'll need access to the ElasticSearch API. This requires the following:
- HTTP Basic authentication using the following parameters:
- URL: The endpoint URL for your ElasticSearch instance.
- Username: Your ElasticSearch account username.
- Password: Your ElasticSearch account password.
Search action
If the Elasticsearch security features are enabled, you must have the read index privilege for the target data stream, index, or alias. For cross-cluster search, see Configure privileges for cross-cluster search.
To search a point in time (PIT) for an alias, you must have the read index privilege for the aliasβs data streams or indices.
Create document action
If the Elasticsearch security features are enabled, you must have the create_doc, create, index, or write index privilege.
Capabilities
This connector provides the following capabilities:
- Search data stored in Elasticsearch indices and data streams.
- Add a JSON document to the specified data stream or index
- Delete a JSON document by index and ID
Actions Setup
Add Document
Please see the time units convention if you want to use the timeout configuration.
Notes
Additional Documentation
Configurations
HTTP Basic Authentication
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Username | string | Required |
password | Password | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Create Document
Create a new document in the specified index with a unique ID in ElasticSearch V7. Requires 'index' and 'id' as path parameters.
Endpoint
- URL: {{index}}/_doc/{{id}}
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.index | string | Required | Parameters for the Create Document action |
path_parameters.id | string | Required | Parameters for the Create Document action |
Input Example
{"json_body":{"test":"test"},"path_parameters":{"index":".internal.alerts-security.alerts-default-000001","id":"test123"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
_index | string | Output field: _index |
_id | string | Unique identifier |
_version | number | Output field: _version |
result | string | Result of the operation |
_shards | object | Output field: _shards |
_shards.total | number | Output field: _shards.total |
_shards.successful | number | Whether the operation was successful |
_shards.failed | number | Output field: _shards.failed |
_seq_no | number | Output field: _seq_no |
_primary_term | number | Output field: _primary_term |
Output Example
{"status_code":201,"response_headers":{"Location":"/.internal.alerts-security.alerts-default-000001/_doc/test123","X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"189"},"reason":"Created","json_body":{"_index":".internal.alerts-security.alerts-default-000001","_id":"test123","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":3306,"_primary_term":7}}
Delete Document
Remove a specified document from an ElasticSearch V7 index using the provided index and document ID.
Endpoint
- URL: {{index}}/_doc/{{id}}
- Method: DELETE
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.index | string | Required | Parameters for the Delete Document action |
path_parameters.id | string | Required | Parameters for the Delete Document action |
Input Example
{"path_parameters":{"index":".internal.alerts-security.alerts-default-000001","id":"test123"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
_index | string | Output field: _index |
_id | string | Unique identifier |
_version | number | Output field: _version |
result | string | Result of the operation |
_shards | object | Output field: _shards |
_shards.total | number | Output field: _shards.total |
_shards.successful | number | Whether the operation was successful |
_shards.failed | number | Output field: _shards.failed |
_seq_no | number | Output field: _seq_no |
_primary_term | number | Output field: _primary_term |
Output Example
{"status_code":200,"response_headers":{"X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"189"},"reason":"OK","json_body":{"_index":".internal.alerts-security.alerts-default-000001","_id":"test123","_version":2,"result":"deleted","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":3307,"_primary_term":7}}
Search Index
Perform a search query on a specified index in ElasticSearch V7 using path and query parameters. Requires the 'index' as a path parameter.
Endpoint
- URL: {{index}}/_search
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.index | string | Required | Parameters for the Search Index action |
parameters.q | string | Optional | Parameters for the Search Index action |
parameters.index | string | Required | Parameters for the Search Index action |
Input Example
{"parameters":{"q":"test","index":".internal.alerts-security.alerts-default-000001"},"path_parameters":{"index":".internal.alerts-security.alerts-default-000001","id":"test123"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
took | number | Output field: took |
timed_out | boolean | Output field: timed_out |
_shards | object | Output field: _shards |
_shards.total | number | Output field: _shards.total |
_shards.successful | number | Whether the operation was successful |
_shards.skipped | number | Output field: _shards.skipped |
_shards.failed | number | Output field: _shards.failed |
hits | object | Output field: hits |
hits.total | object | Output field: hits.total |
hits.total.value | number | Value for the parameter |
hits.total.relation | string | Output field: hits.total.relation |
hits.max_score | number | Score value |
hits.hits | array | Output field: hits.hits |
hits.hits._index | string | Output field: hits.hits._index |
hits.hits._id | string | Unique identifier |
hits.hits._score | number | Score value |
hits.hits._source | object | Output field: hits.hits._source |
hits.hits._source.kibana.version | string | Output field: hits.hits._source.kibana.version |
hits.hits._source.kibana.alert.rule.category | string | Output field: hits.hits._source.kibana.alert.rule.category |
hits.hits._source.kibana.alert.rule.consumer | string | Output field: hits.hits._source.kibana.alert.rule.consumer |
hits.hits._source.kibana.alert.rule.execution.uuid | string | Unique identifier |
hits.hits._source.kibana.alert.rule.name | string | Name of the resource |
hits.hits._source.kibana.alert.rule.producer | string | Output field: hits.hits._source.kibana.alert.rule.producer |
Output Example
{"status_code":200,"response_headers":{"X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"72165"},"reason":"OK","json_body":{"took":905,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{},"max_score":3.5640192,"hits":[]}}}
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 72165 |
content-type | The media type of the resource | application/json |
Location | The URL to redirect a page to | /.internal.alerts-security.alerts-default-000001/_doc/test123 |
X-elastic-product | HTTP response header: X-elastic-product | Elasticsearch |