---
title: Choose the right step
description: Decision aid for picking the right workflow step. Start from what you want to do; end at the step you need.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/authoring-techniques/choose-the-right-step
products:
- Elastic Cloud Enterprise
- Elastic Cloud Hosted
- Elastic Cloud Serverless
- Elastic Cloud on Kubernetes
- Elastic Stack
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Generally available since 9.4
---
# Choose the right step
Workflows ship with many step types. This page is keyed by intent: find the row that matches what you're trying to do; the right column gives you the step you need and links to its reference.
For an alphabetical catalog of every step type, refer to the [Step type index](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/reference/step-types).
## I want to…
### …query or modify Elasticsearch data
| Intent | Step |
|--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Run a Query DSL search | [`elasticsearch.search`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch) |
| Run an ES|QL query | [`elasticsearch.esql.query`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch) |
| Index one document | [`elasticsearch.index`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch) |
| Index many documents efficiently | [`elasticsearch.bulk`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch) |
| Update a document | [`elasticsearch.update`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch) |
| Create, delete, or check an index | [`elasticsearch.indices.create`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch), [`elasticsearch.indices.delete`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch), [`elasticsearch.indices.exists`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch) |
| Call an Elasticsearch API not listed above | [`elasticsearch.request`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/elasticsearch) |
### …work with cases
| Intent | Step |
|----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Create a case | [`cases.createCase`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-createcase) |
| Look up a case | [`cases.getCase`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-getcase), [`cases.findCases`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-findcases), [`cases.getCasesByAlertId`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-getcasesbyalertid) |
| Change status, severity, or tags | [`cases.updateCase`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-updatecase) or the field-specific `set*` steps |
| Attach alerts or observables | [`cases.addAlerts`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-addalerts), [`cases.addObservables`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-addobservables) |
| Add a comment | [`cases.addComment`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-addcomment) |
| Close the case | [`cases.closeCase`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-closecase) |
| Assign or unassign | [`cases.assignCase`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-assigncase), [`cases.unassignCase`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/cases#cases-unassigncase) |
The `kibana.*` case steps (`kibana.createCase`, `kibana.getCase`, `kibana.updateCase`, `kibana.addCaseComment`) are deprecated. Use the `cases.*` replacements. Refer to [Migrate workflows from 9.3 to 9.4](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/authoring-techniques/migrate-from-9-3).
### …manage detection alerts
| Intent | Step |
|-----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
| Change alert status (`open`, `closed`, `acknowledged`, `in-progress`) | [`kibana.SetAlertsStatus`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/kibana) (PascalCase) |
| Add or remove tags on alerts | [`kibana.SetAlertTags`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/kibana) (PascalCase) |
### …call an external system
| Intent | Step |
|--------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| There's a dedicated Kibana connector (Slack, Jira, PagerDuty, and so on) | The connector's named step, for example [`slack.postMessage`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/external-systems-apps). |
| No dedicated connector, credentials matter | [`http`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/external-systems-apps) with a configured HTTP connector for secrets storage. |
| No dedicated connector, quick one-off | [`http`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/external-systems-apps) without a `connector-id`. |
### …branch or loop
| Intent | Step |
|------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Conditional branch | [`if`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/if) |
| Multi-way dispatch on a value | [`switch`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/switch) |
| Iterate over an array | [`foreach`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/foreach) |
| Loop until a condition is false | [`while`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/while) |
| Fan out to independent executions | [`workflow.executeAsync`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/composition) |
| Exit or skip a loop iteration | [`loop.break`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/loop-break), [`loop.continue`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/loop-continue) |
| Small conditional on a single step | Step-level `if:` field. Refer to the [Steps overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps). |
### …pause
| Intent | Step |
|-----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Fixed-duration pause | [`wait`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/wait) |
| Pause for human input | [`waitForInput`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/wait-for-input). Refer to [Human-in-the-loop](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/authoring-techniques/human-in-the-loop). |
### …transform data between steps
| Intent | Step |
|---------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Set a named variable | [`data.set`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-set) |
| Map each element of an array to a new shape | [`data.map`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-map) |
| Keep only matching elements | [`data.filter`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-filter) |
| Find the first matching element | [`data.find`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-find) |
| Group and aggregate | [`data.aggregate`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-aggregate) |
| Concatenate arrays | [`data.concat`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-concat) |
| Remove duplicates | [`data.dedupe`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-dedupe) |
| Parse or serialize JSON | [`data.parseJson`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-parsejson), [`data.stringifyJson`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-stringifyjson) |
| Extract or replace through regex | [`data.regexExtract`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-regexextract), [`data.regexReplace`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/data#data-regexreplace) |
| A small inline transform | [Liquid templating](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/templating), no step needed |
### …call an AI model
| Intent | Step |
|---------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| General prompt, optionally with structured output | [`ai.prompt`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/ai-steps#ai-prompt) |
| Classify into a fixed category set | [`ai.classify`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/ai-steps#ai-classify) |
| Summarize content | [`ai.summarize`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/ai-steps#ai-summarize) |
| Invoke an Elastic Agent Builder agent | [`ai.agent`](/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/ai-steps#ai-agent) |
### …call another workflow
| Intent | Step |
|--------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Synchronous: parent waits for the child's result | [`workflow.execute`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/composition) Elastic Stack: Preview since 9.4 |
| Fire-and-forget | [`workflow.executeAsync`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/composition) Elastic Stack: Preview since 9.4 |
| Emit outputs from a child workflow | [`workflow.output`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/composition) Elastic Stack: Preview since 9.4 |
| Explicitly terminate a workflow as failed | [`workflow.fail`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/composition) Elastic Stack: Preview since 9.4 |
### …log or debug
| Intent | Step |
|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Log a message to the execution view | [`console`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps/external-systems-apps) |
| Understand what a step produced mid-run | Inspect the step's output in the execution view. Refer to [Monitor workflow execution](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/authoring-techniques/monitor-workflows). |
| Log only when running a test | `console` with a step-level `if: "execution.isTestRun"` |
## Still not sure?
Browse the [Step type index](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/reference/step-types) for an A-to-Z list, or use the YAML editor's autocomplete in Kibana. The autocomplete surfaces every step type with its description as you type.
## Related
- [Anatomy of a workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/authoring-techniques/anatomy): Every top-level field and the execution lifecycle.
- [Steps overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/steps): The step catalog organized by category.
- [Step type index](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/reference/step-types): Alphabetical lookup for every step type.
- [Cheat sheet](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6669/explore-analyze/workflows/reference/cheat-sheet): One-page bookmark reference.