--- title: Workflows cheat sheet description: One-page bookmark reference for Elastic Workflows. Workflow anatomy, triggers, step skeleton, the step menu, Liquid, error handling, and the top gotchas. url: https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/reference/cheat-sheet products: - Elastic Cloud Enterprise - Elastic Cloud Hosted - Elastic Cloud Serverless - Elastic Cloud on Kubernetes - Elastic Stack - Kibana applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Generally available since 9.4, Preview in 9.3 --- # Workflows cheat sheet One-page reference. Bookmark this. ## Workflow anatomy ```yaml name: my-workflow description: ... enabled: true tags: [team, domain] version: "1" triggers: [ ... ] inputs: [ ... ] consts: { ... } outputs: [ ... ] settings: { ... } steps: [ ... ] ``` ## Triggers ```yaml triggers: - type: manual - type: scheduled with: every: "5m" # or: rrule with freq DAILY/WEEKLY/MONTHLY - type: alert - type: workflows.failed on: condition: "event.workflow.name : 'critical-ingest-pipeline'" ``` Minimum schedule interval: **1 minute**. Refer to [Triggers](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/triggers). ## Step skeleton ```yaml - name: my_step type: some.step_type connector-id: "my-connector" if: "inputs.run_me : true" foreach: "{{ some.array }}" timeout: "30s" on-failure: retry: max-attempts: 3 delay: "5s" strategy: exponential continue: true with: # step-specific parameters. # Note: workflow.execute / workflow.executeAsync use `workflow-id` INSIDE `with`. ``` ## Step menu by intent | Want to… | Use | |-----------------------------------|----------------------------------------------------------------------------------------| | Query Elasticsearch | `elasticsearch.search`, `elasticsearch.esql.query` | | Write to Elasticsearch | `elasticsearch.index`, `elasticsearch.bulk`, `elasticsearch.update` | | Manage cases | `cases.createCase`, `cases.updateCase`, `cases.addComment`, `cases.addAlerts` | | Manage alerts | `kibana.SetAlertsStatus`, `kibana.SetAlertTags` (PascalCase) | | Call an API | `http` (with optional `connector-id`) | | Call a service | `.` (for example, `slack.postMessage`, `jira.createIssue`) | | Branch | `if`, `switch` | | Loop | `foreach`, `while`, `loop.break`, `loop.continue` | | Fan out to independent executions | `workflow.executeAsync` (tech preview) | | Pause | `wait`, `waitForInput` | | Transform data | `data.filter`, `data.map`, `data.aggregate`, `data.parseJson`, `data.regexExtract` | | Call AI | `ai.prompt`, `ai.classify`, `ai.summarize`, `ai.agent` | | Call another workflow | `workflow.execute` (synchronous), `workflow.executeAsync` (asynchronous, tech preview) | | Log | `console` | Full list: [Step type index](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/reference/step-types). ## Liquid quick reference ```yaml "{{ expr }}" "${{ expr }}" ``` Top-10 patterns: ```yaml "{{ inputs.name }}" "{{ steps.search.output.hits.total.value }}" "{{ event.alerts[0].host.name }}" "{{ foreach.item._id }}" "{{ variables.threshold }}" "{{ now | date: '%Y-%m-%d' }}" "{{ steps.x.output.body | json_parse }}" "{{ event | json }}" "{{ event.alerts[0].host.name | default: 'unknown' }}" "${{ event.alerts | where: 'severity', 'critical' }}" ``` Full reference: [Liquid filters](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/reference/liquid-filters). ## Context variables at a glance | Variable | Contains | |-----------------------|----------------------------------------------------------| | `inputs.*` | Workflow inputs at runtime. | | `consts.*` | Constants from workflow top. | | `steps..output` | Output of a previous step. | | `steps..error` | Error if that step failed (with `on-failure: continue`). | | `event.*` | Trigger payload. | | `execution.*` | Current execution metadata. | | `workflow.*` | Workflow metadata. | | `foreach.*` | Loop context: `item`, `index`, `total`, `items`. | | `while.iteration` | Zero-based iteration counter inside a `while` loop. | | `variables.*` | Variables set by `data.set`. | | `now`, `kibanaUrl` | Standard helpers. | Full reference: [Context variables](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/reference/context-variables). ## Error-handling strategies ```yaml on-failure: retry: max-attempts: 3 delay: "5s" strategy: exponential # or "fixed" jitter: true condition: "steps.self.error.status : 429" continue: true fallback: [ ... ] # abort is the default when no on-failure is set ``` Precedence: per-step `on-failure` > workflow-level `settings.on-failure` > `abort`. For cross-workflow error handling (page on-call when another workflow fails), use the [`workflows.failed` event-driven trigger](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/triggers/event-driven-triggers). Full reference: [Pass data and handle errors](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors). ## Top gotchas 1. **Alert trigger needs rule Action attachment.** `type: alert` alone isn't enough. [Attach the workflow](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/triggers/alert-triggers) to the rule's Actions. 2. **`while` defaults to `max-iterations: 2000` with `on-limit: continue`.** When the loop hits the cap, the step succeeds quietly. Set `on-limit: fail` if you want the workflow to fail at the cap. 3. **`switch.cases` is an array**, not a map. Each case is a `{ case: , steps: [...] }` object. Refer to [`switch`](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/steps/switch). 4. **`cases.*` parameters use `snake_case`:** `case_id`, not `caseId`. 5. **`kibana.SetAlertsStatus` / `kibana.SetAlertTags` are PascalCase.** Not `kibana.set_alerts_status`. 6. **AI step identifiers are top-level kebab-case:** `connector-id`, `agent-id`, `inference-id`. 7. **Composition's `workflow-id` is kebab-case but lives *inside* `with`.** It's the one exception to the top-level-kebab-case pattern. 8. **`data.*` steps (except `data.set`) put source data at the top level:** `items:`, `arrays:`, or `source:`. The transformation configuration goes in `with`. 9. **Use `${{ ... }}` for arrays and objects**, `{{ ... }}` for strings. 10. **`to_json` doesn't exist.** Use `json` to serialize or `json_parse` to parse. 11. **`data.filter` and `if` conditions are KQL, not Liquid.** Use `item.severity : 'critical'`, not `item.severity == 'critical'`. ## Related - [Build your first workflow](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/get-started/build-your-first-workflow): Hands-on tutorial if you're new. - [Step type index](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/reference/step-types): The A-Z lookup. - [Troubleshooting](https://www.elastic.co/elastic/docs-builder/docs/3276/explore-analyze/workflows/authoring-techniques/troubleshooting): When something isn't working. - [`elastic/workflows` library](https://github.com/elastic/workflows): 57 example workflows you can adapt.