---
title: Elasticsearch V7
slug: connectors/elasticsearch-v7
docTags: 
createdAt: 2026-06-09T16:30:11.190Z
---

## Elastic Elasticsearch 7

ElasticSearch V7 is an open-source search and analytics engine that provides fast and scalable data retrieval and analysis.

ElasticSearch V7 is a powerful search and analytics engine that enables users to store, search, and analyze large volumes of data quickly and in near real-time. This connector allows Swimlane Turbine users to automate key ElasticSearch operations such as creating, deleting, and searching documents within indices. By integrating ElasticSearch V7 with Swimlane Turbine, users can enhance their security analytics capabilities, streamline data management, and improve incident response times through automated workflows.

## Prerequisites

Before you can use the ElasticSearch V7 connector for Turbine, you'll need access to the ElasticSearch API. This requires the following:

- HTTP Basic authentication using the following parameters:
  - URL: The endpoint URL for your ElasticSearch instance.
  - Username: Your ElasticSearch account username.
  - Password: Your ElasticSearch account password.

## Search action

If the Elasticsearch security features are enabled, you must have the read [index privilege](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-indices) for the target data stream, index, or alias. For cross-cluster search, see [Configure privileges for cross-cluster search](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-privileges.html#remote-clusters-privileges-ccs).

To search a [point in time (PIT)](https://www.elastic.co/guide/en/elasticsearch/reference/current/point-in-time-api.html) for an alias, you must have the read index privilege for the alias’s data streams or indices.

### Create document action

If the Elasticsearch security features are enabled, you must have the `create_doc`, `create`, `index`, or `write` [index privilege](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-indices).

## Capabilities

This connector provides the following capabilities:

- Search data stored in Elasticsearch indices and data streams.
- Add a JSON document to the specified data stream or index
- Delete a JSON document by index and ID

## Actions Setup

### Add Document

Please see the [time units convention](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) if you want to use the `timeout` configuration.

## Notes

- [Index API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html)
- [Search API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search.html)
- [Time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units)
- [index privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-indices)
- [Configure privileges for cross-cluster search](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-privileges.html#remote-clusters-privileges-ccs)
- [Point in Time (PIT)](https://www.elastic.co/guide/en/elasticsearch/reference/current/point-in-time-api.html)

## Additional Documentation

- [Elasticsearch V7 Connector Documentation](https://docs.swimlane.com/connectors/elasticsearch-v7)
- [Elasticsearch V7 API Documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html)

# Configurations

## HTTP Basic Authentication

Authenticates using username and password.

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| username      | Username                           | string   | Required     |
| password      | Password                           | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Create Document

Create a new document in the specified index with a unique ID in ElasticSearch V7. Requires 'index' and 'id' as path parameters.

### Endpoint

- **URL:** `{{index}}/_doc/{{id}}`
- **Method:** `POST`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                           |
| ----------------------- | -------- | ------------ | ----------------------------------------- |
| `path_parameters.index` | string   | Required     | Parameters for the Create Document action |
| `path_parameters.id`    | string   | Required     | Parameters for the Create Document action |

### Input Example

`{"json_body":{"test":"test"},"path_parameters":{"index":".internal.alerts-security.alerts-default-000001","id":"test123"}}`

### Output

| **Parameter**        | **Type** | **Description**                      |
| -------------------- | -------- | ------------------------------------ |
| `status_code`        | number   | HTTP status code of the response     |
| `reason`             | string   | Response reason phrase               |
| `_index`             | string   | Output field: \_index                |
| `_id`                | string   | Unique identifier                    |
| `_version`           | number   | Output field: \_version              |
| `result`             | string   | Result of the operation              |
| `_shards`            | object   | Output field: \_shards               |
| `_shards.total`      | number   | Output field: \_shards.total         |
| `_shards.successful` | number   | Whether the operation was successful |
| `_shards.failed`     | number   | Output field: \_shards.failed        |
| `_seq_no`            | number   | Output field: \_seq\_no              |
| `_primary_term`      | number   | Output field: \_primary\_term        |

### Output Example

`{"status_code":201,"response_headers":{"Location":"/.internal.alerts-security.alerts-default-000001/_doc/test123","X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"189"},"reason":"Created","json_body":{"_index":".internal.alerts-security.alerts-default-000001","_id":"test123","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":3306,"_primary_term":7}}`

## Delete Document

Remove a specified document from an ElasticSearch V7 index using the provided index and document ID.

### Endpoint

- **URL:** `{{index}}/_doc/{{id}}`
- **Method:** `DELETE`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                           |
| ----------------------- | -------- | ------------ | ----------------------------------------- |
| `path_parameters.index` | string   | Required     | Parameters for the Delete Document action |
| `path_parameters.id`    | string   | Required     | Parameters for the Delete Document action |

### Input Example

`{"path_parameters":{"index":".internal.alerts-security.alerts-default-000001","id":"test123"}}`

### Output

| **Parameter**        | **Type** | **Description**                      |
| -------------------- | -------- | ------------------------------------ |
| `status_code`        | number   | HTTP status code of the response     |
| `reason`             | string   | Response reason phrase               |
| `_index`             | string   | Output field: \_index                |
| `_id`                | string   | Unique identifier                    |
| `_version`           | number   | Output field: \_version              |
| `result`             | string   | Result of the operation              |
| `_shards`            | object   | Output field: \_shards               |
| `_shards.total`      | number   | Output field: \_shards.total         |
| `_shards.successful` | number   | Whether the operation was successful |
| `_shards.failed`     | number   | Output field: \_shards.failed        |
| `_seq_no`            | number   | Output field: \_seq\_no              |
| `_primary_term`      | number   | Output field: \_primary\_term        |

### Output Example

`{"status_code":200,"response_headers":{"X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"189"},"reason":"OK","json_body":{"_index":".internal.alerts-security.alerts-default-000001","_id":"test123","_version":2,"result":"deleted","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":3307,"_primary_term":7}}`

## Search Index

Perform a search query on a specified index in ElasticSearch V7 using path and query parameters. Requires the 'index' as a path parameter.

### Endpoint

- **URL:** `{{index}}/_search`
- **Method:** `GET`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                        |
| ----------------------- | -------- | ------------ | -------------------------------------- |
| `path_parameters.index` | string   | Required     | Parameters for the Search Index action |
| `parameters.q`          | string   | Optional     | Parameters for the Search Index action |
| `parameters.index`      | string   | Required     | Parameters for the Search Index action |

### Input Example

`{"parameters":{"q":"test","index":".internal.alerts-security.alerts-default-000001"},"path_parameters":{"index":".internal.alerts-security.alerts-default-000001","id":"test123"}}`

### Output

| **Parameter**                                        | **Type** | **Description**                                             |
| ---------------------------------------------------- | -------- | ----------------------------------------------------------- |
| `status_code`                                        | number   | HTTP status code of the response                            |
| `reason`                                             | string   | Response reason phrase                                      |
| `took`                                               | number   | Output field: took                                          |
| `timed_out`                                          | boolean  | Output field: timed\_out                                    |
| `_shards`                                            | object   | Output field: \_shards                                      |
| `_shards.total`                                      | number   | Output field: \_shards.total                                |
| `_shards.successful`                                 | number   | Whether the operation was successful                        |
| `_shards.skipped`                                    | number   | Output field: \_shards.skipped                              |
| `_shards.failed`                                     | number   | Output field: \_shards.failed                               |
| `hits`                                               | object   | Output field: hits                                          |
| `hits.total`                                         | object   | Output field: hits.total                                    |
| `hits.total.value`                                   | number   | Value for the parameter                                     |
| `hits.total.relation`                                | string   | Output field: hits.total.relation                           |
| `hits.max_score`                                     | number   | Score value                                                 |
| `hits.hits`                                          | array    | Output field: hits.hits                                     |
| `hits.hits._index`                                   | string   | Output field: hits.hits.\_index                             |
| `hits.hits._id`                                      | string   | Unique identifier                                           |
| `hits.hits._score`                                   | number   | Score value                                                 |
| `hits.hits._source`                                  | object   | Output field: hits.hits.\_source                            |
| `hits.hits._source.kibana.version`                   | string   | Output field: hits.hits.\_source.kibana.version             |
| `hits.hits._source.kibana.alert.rule.category`       | string   | Output field: hits.hits.\_source.kibana.alert.rule.category |
| `hits.hits._source.kibana.alert.rule.consumer`       | string   | Output field: hits.hits.\_source.kibana.alert.rule.consumer |
| `hits.hits._source.kibana.alert.rule.execution.uuid` | string   | Unique identifier                                           |
| `hits.hits._source.kibana.alert.rule.name`           | string   | Name of the resource                                        |
| `hits.hits._source.kibana.alert.rule.producer`       | string   | Output field: hits.hits.\_source.kibana.alert.rule.producer |

### Output Example

`{"status_code":200,"response_headers":{"X-elastic-product":"Elasticsearch","content-type":"application/json","content-length":"72165"},"reason":"OK","json_body":{"took":905,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{},"max_score":3.5640192,"hits":[]}}}`

# Response Headers

| **Header**        | **Description**                          | **Example**                                                    |
| ----------------- | ---------------------------------------- | -------------------------------------------------------------- |
| content-length    | The length of the response body in bytes | 72165                                                          |
| content-type      | The media type of the resource           | application/json                                               |
| Location          | The URL to redirect a page to            | /.internal.alerts-security.alerts-default-000001/\_doc/test123 |
| X-elastic-product | HTTP response header: X-elastic-product  | Elasticsearch                                                  |