Index Search Query

Triggers a workflow on every new event based on a target index (mandatory) and a search query (optional).

info

Automations based on this trigger will search for new events every 5 minutes.

Parameters

Parameter	Description
Query	Defines the search using a Query in the Lucene query string syntax. Note: It is not advised to query time elements, as the trigger handles this by default. Querying time elements might interfere with the proper execution of the trigger.
Target Index	Comma-separated list of data streams, indices, and aliases to search. Supports wildcards (). To search all data streams and indices, use or _all.

Sample Event

{
    "_index": "my-index-000001",
    "_id": "0",
    "_score": 1.3862942,
    "_source": {
        "@timestamp": "YYYY-MM-DDTHH:MM:SS.sssZ",
        "http": {
            "request": {
                "method": "get"
            },
            "response": {
                "status_code": 200,
                "bytes": 1070000
            },
            "version": "1.1"
        },
        "source": {
            "ip": "127.0.0.1"
        },
        "message": "GET /search HTTP/1.1 200 1070000",
        "user": {
            "id": "kimchy"
        }
    }
}