---
title: "Elasticsearch"
description: "Reference for the Tracecat Elasticsearch integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## List indexes

Action ID: `tools.elasticsearch.list_indexes`

List all indexes in the Elasticsearch cluster.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices)

### Secrets

Required secrets:

- `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">

Elasticsearch base URL (e.g. https://localhost:9200).

Default: `null`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Search events

Action ID: `tools.elasticsearch.search_events`

Search events from Elasticsearch using query DSL.

Reference: [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search)

### Secrets

Required secrets:

- `elasticsearch`: required values `ELASTIC_API_KEY`.

### Input fields

<ParamField path="query" type="object" required>

Elasticsearch query DSL.

</ParamField>

<ParamField path="base_url" type="string | null">

Elasticsearch base URL (e.g. https://localhost:9200).

Default: `null`.

</ParamField>

<ParamField path="index" type="string | null">

Index name to search. If not specified, searches all indices.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of events to return.

Default: `100`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>
