Elasticsearch

Connect AI agents to Elasticsearch and Elastic Cloud. Agents index and search documents with full Query DSL, run bulk NDJSON operations, update or delete by query, and manage indices.

18 actions available

An incident is flagged by an upstream monitor

Agent runs Search with a Query DSL body to find the matching log documents

Agent reads the top hits and relevant fields

Agent runs Count to measure how many documents match the alert query

If the total crosses a threshold, agent emails a summary via Gmail

Agent runs Bulk to index enriched records back for future search

Any Delete By Query or Delete Index against a production index pauses for approval

What This Integration Enables

Agents index application data and content and make it full-text searchable, run Query DSL searches, counts, and aggregations, bulk-load or synchronize datasets in a single NDJSON request, update or delete documents matching a query, and manage index lifecycle. The Bulk action builds the newline-delimited JSON the `_bulk` API expects from a simple array of operation objects. Write operations expose a Refresh option so an agent can force freshly written documents to be searchable immediately when a step depends on it.

Without FlowRunner

Search behind a UI Investigating an incident means clicking through Kibana by hand

One-by-one indexing Loading records into an index is a slow per-document loop

By-query deletes unguarded A Delete By Query can remove far more than intended

With FlowRunner

Search in the flow A Query DSL search drives alerts and downstream steps automatically

Bulk NDJSON loads Bulk indexes or updates a whole dataset in a single request

Guarded by-query ops Delete By Query and Delete Index pause for human approval

Use Case Scenarios

Incident triage from logs

An incident is flagged. The agent runs Search with a Query DSL body to pull the matching log documents, reads the top hits, and alerts the on-call team with Slack. It also runs Count to measure the blast radius, and escalates by email when the total crosses a threshold. The triage that meant clicking through Kibana now happens as a flow step.

Bulk sync from another system

The agent pulls recent records from another connector, then calls Bulk to index them all in a single NDJSON request so they become searchable. A per-document indexing loop becomes one efficient call.

Reindex cleanup with a human gate

During a reindex or retention pass, the agent needs to remove documents by query or drop an old index. Before it runs Delete By Query or Delete Index against production, it does not act on its own. It routes the query or index name and a matched count for approval, and runs it only after a person confirms.

Human-in-Loop Highlight

Delete By Query is the action that turns one wrong filter into a large, silent data loss, and Delete Index removes an index outright. FlowRunner's answer is human-in-the-loop, an execution pattern where the agent pauses on its own, assembles the context and the choices, routes to a human on their preferred channel, and resumes the moment they respond. When a Delete By Query would match more documents than the configured threshold, or a flow reaches Delete Index on a production index, the agent runs Count first, then pauses and asks through Slack: "This Delete By Query on `logs-prod` matches 148,000 documents. Here is the query. Approve, narrow the query, or cancel?" The operation runs only after a person confirms, with the approver and timestamp captured in the run log. A connector can run any query; an orchestration layer knows which queries should stop and ask.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via Slack

Human decides

Agent resumes with decision

Agent Capabilities

18 actions

Documents

Bulk Runs many index, create, update, or delete operations in a single NDJSON request, for loading or synchronizing large datasets efficiently.
Delete Document Deletes one document by id from an index.
Get Document Fetches one document by id from an index.
Index Document Indexes (creates or replaces) one document so it becomes searchable.
Update Document Partially updates one document by id with a doc or script.

Search

Count Returns the number of documents matching a Query DSL query, for threshold and alerting logic.
Search Runs a full Query DSL search across one or more indices and returns the matching hits, aggregations, and metadata.

Query By

Delete By Query Deletes every document matching a Query DSL query without fetching them first.
Update By Query Updates every document matching a Query DSL query with a script, without fetching them first.

Indices

Create Index Creates an index with mappings and settings.
Delete Index Permanently deletes an index and all of its documents.
Get Index Returns the settings, mappings, and aliases of an index.
Get Mapping Returns the field mappings of an index.
Index Exists Checks whether an index exists, returning a boolean.
List Indices Lists the indices in the cluster, for discovery.
Refresh Index Forces an index refresh so recent writes become searchable immediately.

Cluster

Cluster Health Returns the cluster health status (green, yellow, or red) as a readiness check.
Info Returns cluster and version info, a lightweight connectivity and credential check.

Start building with Elasticsearch

$100 in credits. No card required. Connect in minutes.

Start Building Free Talk to us