--- title: "Elasticsearch Integration" description: "Connect AI agents to Elasticsearch and Elastic Cloud. Agents index and search documents with full Query DSL, run bulk NDJSON operations, update or delete by query, and manage indices." url: https://flowrunner.ai/integrations/elasticsearch date_modified: 2026-08-01T02:40:32-07:00 --- # Elasticsearch [Database](https://flowrunner.ai/integrations/category/databases-warehouses) Connect AI agents to Elasticsearch and Elastic Cloud. Agents index and search documents with full Query DSL, run bulk NDJSON operations, update or delete by query, and manage indices. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 18 actions · API key · available [Elasticsearch website](https://elastic.co/) · [Platform Documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html) · Capability data verified 2026-07-14 1. An incident is flagged by an upstream monitor 2. Agent runs Search with a Query DSL body to find the matching log documents 3. Agent reads the top hits and relevant fields 4. Agent runs Count to measure how many documents match the alert query 5. If the total crosses a threshold, agent emails a summary via Gmail 6. Agent runs Bulk to index enriched records back for future search 7. Any Delete By Query or Delete Index against a production index pauses for approval ## What This Integration Enables Agents index application data and content and make it full-text searchable, run Query DSL searches, counts, and aggregations, bulk-load or synchronize datasets in a single NDJSON request, update or delete documents matching a query, and manage index lifecycle. The Bulk action builds the newline-delimited JSON the `_bulk` API expects from a simple array of operation objects. Write operations expose a Refresh option so an agent can force freshly written documents to be searchable immediately when a step depends on it. ### Without FlowRunner **Search behind a UI**: Investigating an incident means clicking through Kibana by hand **One-by-one indexing**: Loading records into an index is a slow per-document loop **By-query deletes unguarded**: A Delete By Query can remove far more than intended ### With FlowRunner **Search in the flow**: A Query DSL search drives alerts and downstream steps automatically **Bulk NDJSON loads**: Bulk indexes or updates a whole dataset in a single request **Guarded by-query ops**: Delete By Query and Delete Index pause for human approval ## Use Case Scenarios ### Incident triage from logs An incident is flagged. The agent runs Search with a Query DSL body to pull the matching log documents, reads the top hits, and alerts the on-call team with Slack. It also runs Count to measure the blast radius, and escalates by email when the total crosses a threshold. The triage that meant clicking through Kibana now happens as a flow step. ### Bulk sync from another system The agent pulls recent records from another connector, then calls Bulk to index them all in a single NDJSON request so they become searchable. A per-document indexing loop becomes one efficient call. ### Reindex cleanup with a human gate During a reindex or retention pass, the agent needs to remove documents by query or drop an old index. Before it runs Delete By Query or Delete Index against production, it does not act on its own. It routes the query or index name and a matched count for approval, and runs it only after a person confirms. ## Human-in-Loop Highlight Delete By Query is the action that turns one wrong filter into a large, silent data loss, and Delete Index removes an index outright. FlowRunner's answer is human-in-the-loop, an execution pattern where the agent pauses on its own, assembles the context and the choices, routes to a human on their preferred channel, and resumes the moment they respond. When a Delete By Query would match more documents than the configured threshold, or a flow reaches Delete Index on a production index, the agent runs Count first, then pauses and asks through Slack: "This Delete By Query on `logs-prod` matches 148,000 documents. Here is the query. Approve, narrow the query, or cancel?" The operation runs only after a person confirms, with the approver and timestamp captured in the run log. A connector can run any query; an orchestration layer knows which queries should stop and ask. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via Slack Human decides Agent resumes with decision ## Agent Capabilities 18 actions ### Documents 5 - **Bulk** Runs many index, create, update, or delete operations in a single NDJSON request, for loading or synchronizing large datasets efficiently. - **Delete Document** Deletes one document by id from an index. - **Get Document** Fetches one document by id from an index. - **Index Document** Indexes (creates or replaces) one document so it becomes searchable. - **Update Document** Partially updates one document by id with a doc or script. ### Search 2 - **Count** Returns the number of documents matching a Query DSL query, for threshold and alerting logic. - **Search** Runs a full Query DSL search across one or more indices and returns the matching hits, aggregations, and metadata. ### Query By 2 - **Delete By Query** Deletes every document matching a Query DSL query without fetching them first. - **Update By Query** Updates every document matching a Query DSL query with a script, without fetching them first. ### Indices 7 - **Create Index** Creates an index with mappings and settings. - **Delete Index** Permanently deletes an index and all of its documents. - **Get Index** Returns the settings, mappings, and aliases of an index. - **Get Mapping** Returns the field mappings of an index. - **Index Exists** Checks whether an index exists, returning a boolean. - **List Indices** Lists the indices in the cluster, for discovery. - **Refresh Index** Forces an index refresh so recent writes become searchable immediately. ### Cluster 2 - **Cluster Health** Returns the cluster health status (green, yellow, or red) as a readiness check. - **Info** Returns cluster and version info, a lightweight connectivity and credential check. ## Frequently Asked Questions ### What can FlowRunner do with Elasticsearch? FlowRunner agents can run Bulk, Delete Document, and Get Document in Elasticsearch, plus 15 more actions. ### Does connecting Elasticsearch to FlowRunner require OAuth? No. Elasticsearch connects to FlowRunner with an API key, no OAuth flow required. ### Can Elasticsearch trigger a FlowRunner workflow automatically? Elasticsearch doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at Elasticsearch?** This integration exposes Elasticsearch to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/elasticsearch. Site index: https://flowrunner.ai/llms.txt