---
title: Glossary
description: Reference of terms used across Elastic Workflows documentation, with concrete examples and links to the canonical reference pages.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/glossary
products:
- Elastic Cloud Enterprise
- Elastic Cloud Hosted
- Elastic Cloud Serverless
- Elastic Cloud on Kubernetes
- Elastic Stack
- Kibana
applies_to:
- Elastic Cloud Serverless: Generally available
- Elastic Stack: Generally available since 9.4
---
# Glossary
Every term and acronym used elsewhere in the Workflows documentation. Each entry links to the canonical reference page where one exists.
## A-B
### Action
In alerting, an operation a rule takes when it fires. Workflows runs as an action through the **Run workflow** rule action. Refer to [Alert triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/alert-triggers).
### Agent Builder
A Kibana feature for building conversational AI agents. Workflows integrates as a tool provider (workflows can be called by agents) and as a step type (`ai.agent` calls agents from a workflow). Refer to [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/ai-features/elastic-agent-builder).
### Alert
A document produced by an alerting rule when it fires. See also [Detection alert](#workflows-glossary-detection-alert).
### Alert state
One of `new`, `ongoing`, or `recovered`. Workflows can trigger on any combination of these states. Refer to [Alert triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/alert-triggers).
### Alerting rule
A Kibana construct that watches data and fires when a condition is met. Triggers alert-type workflows. Refer to [Alert triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/alert-triggers).
### Anatomy
The top-level structure of a workflow YAML file. Refer to [Anatomy of a workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/anatomy).
## C
### Case
A Kibana Cases document for tracking an investigation. Workflows provides 25+ `cases.*` step types. Refer to [Cases action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/cases).
### Composition
- Elastic Cloud Serverless: Preview
- Elastic Stack: Preview since 9.4
Invoking one workflow from another. The parent calls a child through `workflow.execute` (synchronous) or `workflow.executeAsync` (fire-and-forget). Refer to [Composition steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/composition) and [Compose workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/compose-workflows).
### Composition depth
How deep a nested `workflow.execute` chain goes. Capped by the engine to prevent infinite recursion. Refer to [Composition steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/composition).
### Concurrency
Controls for what happens when overlapping executions would otherwise run at the same time. Configured under `settings.concurrency`. Refer to [Workflow settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/settings).
### Connector
A configured integration with an external system (Slack, Jira, PagerDuty, OpenAI, and so on). Referenced from workflow steps by `connector-id`. Refer to [Kibana connectors](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/deploy-manage/manage-connectors).
### Context
The shared data environment a workflow execution builds up as steps run. Accessed in YAML through Liquid templating. Refer to [Pass data and handle errors](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors).
### Context variable
A named item in the workflow context: `inputs.*`, `consts.*`, `steps.*`, `event.*`, `foreach.*`, `execution.*`, and so on. Refer to [Context variables](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/context-variables).
## D-E
### Data step
A step type in the `data.*` namespace for transformations: `data.filter`, `data.map`, `data.aggregate`, and others. Refer to [Data action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/data).
### Detection alert
An alert produced by a Elastic Security detection rule. Always in state `new` when delivered to a workflow. Refer to [Alert triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/alert-triggers).
### ES|QL
Elasticsearch Query Language. Elasticsearch's SQL-like query language. Used in `elasticsearch.esql.query` steps. Refer to [Elasticsearch action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/elasticsearch) and [ES|QL reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql).
### Event
The trigger payload. For alert triggers, the alert data; for scheduled triggers, empty. Accessed as `event.*` in Liquid templates. Refer to [Context variables](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/context-variables).
### Event-driven trigger
- Elastic Cloud Serverless: Preview
- Elastic Stack: Preview since 9.4
A trigger that fires on a platform event rather than on a schedule or manual invocation. Includes `workflows.failed` and the `cases.*` event triggers. Refer to [Event-driven triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/event-driven-triggers).
### Execution
One run of a workflow. Has an ID, a start time, a trigger, a terminal state, and an execution view. Refer to [Monitor workflow execution](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/monitor-workflows).
## F-H
### Fallback
An `on-failure` strategy that runs alternative steps when the primary step fails and all retries are exhausted. Refer to [Pass data and handle errors](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors).
### Fan-out
Starting multiple concurrent pieces of work from one workflow. Implement with [`workflow.executeAsync`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/composition) for independent child executions, or [`foreach`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/foreach) for per-item iteration within one execution.
### Foreach
Both a step type and a step-level field. The step type is a loop; the field is a per-step iteration modifier. Refer to [`foreach`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/foreach) and the [Steps overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps).
### GenAI
Generative AI. A model class that produces text, code, or structured data from a prompt. Workflows integrates through connectors (OpenAI, Bedrock, Gemini, Generic GenAI) and the `ai.*` step types. Refer to [AI steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/ai-steps).
### HITL
Human-in-the-loop. A workflow that pauses for human input, typically through `waitForInput`. Refer to [Human-in-the-loop](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/human-in-the-loop).
## I-K
### Input
A runtime parameter of a workflow. Declared under the `manual` trigger on 9.5+ and serverless, or at the workflow root on 9.4. Refer to [Anatomy: `inputs`](/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/anatomy#workflows-anatomy-inputs).
### KQL
Kibana Query Language. Used for `if` conditions and `data.filter` predicates in workflows. Refer to the [KQL reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/query-filter/languages/kql).
## L
### Liquid
The template language used to reference context variables inside workflow YAML. The engine evaluates expressions like `{{ inputs.name }}` and `${{ steps.fetch.output }}` at runtime. Refer to [Templating engine](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/templating).
## N-O
### Observable
In Cases, an indicator of compromise (IP, hash, domain, URL). Added with `cases.addObservables`. Refer to [`cases.addObservables`](/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/cases#cases-addobservables).
### On-failure
Per-step error-handling configuration. Strategies: `retry`, `continue`, `fallback`, `abort`. Refer to [Pass data and handle errors](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors).
### Output
Either the data a step produces (accessed through `steps..output`), or a top-level declaration of what a workflow returns (required for workflows invoked through composition). Refer to [Anatomy: `outputs`](/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/anatomy#workflows-anatomy-outputs).
## P-R
### RBAC
Role-based access control. Kibana's privilege system. Workflows defines seven sub-feature privileges (`create`, `read`, `update`, `delete`, `execute`, `readExecution`, `cancelExecution`). Refer to [Set up Workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/get-started/setup).
### Resume
Continuing a paused workflow after a `waitForInput` step. Done through the UI or the REST API. Refer to [Human-in-the-loop](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/human-in-the-loop).
### Retry
An `on-failure` strategy that re-runs a step. Supports exponential backoff, jitter, and per-error conditions. Refer to [Pass data and handle errors](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors).
### RRule
Recurrence Rule. The iCalendar recurrence specification. Scheduled triggers accept rrules for calendar-style recurrence. Refer to [Scheduled triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/scheduled-triggers).
## S
### Scheduled trigger
A trigger that runs a workflow on a time-based schedule. Refer to [Scheduled triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/scheduled-triggers).
### Schema (output)
The declared shape of a workflow's outputs. Required for workflows invoked through `workflow.execute`. The engine validates child outputs against this schema before returning them to the parent. Refer to [Anatomy: `outputs`](/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/anatomy#workflows-anatomy-outputs).
### Space
A Kibana tenancy construct. Workflows belong to spaces; triggers and connectors scope to the space.
### Step
One unit of work in a workflow. Has a `name`, a `type`, and step-specific parameters. Refer to the [Steps overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps).
### Step type
The identifier of a particular kind of step (`elasticsearch.search`, `cases.createCase`, and so on). Refer to the [Step type index](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/step-types).
### Streams
- Elastic Cloud Serverless: Preview
- Elastic Stack: Preview since 9.4
A Kibana Observability feature. Workflow steps in the `kibana.streams.*` namespace operate on Observability streams. Refer to [Streams action steps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/streams).
## T
### Tech Preview
A stability level. Features are usable and documented, but the schema or behavior can change in future releases. Marked with `applies_to: : preview` in this docset; the badge appears at the top of each affected page and beside the navigation entry.
### Terminal state
An execution's final state. One of `completed`, `failed`, `cancelled`, `timed_out`, or `skipped`. Refer to [Anatomy: execution lifecycle](/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/anatomy#workflows-anatomy-lifecycle).
### Trigger
What starts a workflow. Supported types: `manual`, `scheduled`, `alert`, `workflows.failed`, and the `cases.*` event-driven triggers. Refer to [Triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers).
## V-W
### Variables
Named values set by `data.set` steps. Global within an execution. Accessed as `variables.`. Refer to [`data.set`](/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/data#data-set).
### waitForInput
The human-in-the-loop primitive. Pauses a workflow for human input. Refer to [Human-in-the-loop](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/human-in-the-loop) and [`waitForInput`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/steps/wait-for-input).
### Workflow
A declarative YAML automation. The primary unit of work in Elastic Workflows. Refer to [Anatomy of a workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/authoring-techniques/anatomy).
### `workflows.failed`
- Elastic Cloud Serverless: Preview
- Elastic Stack: Preview since 9.4
An [event-driven trigger](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/triggers/event-driven-triggers) that fires when another workflow's execution reaches the `failed` terminal state. Used to build handler workflows that react to failures.
## Y
### YAML
YAML Ain't Markup Language. The format in which workflows are authored. Whitespace-sensitive.
## Related
- [Cheat sheet](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/cheat-sheet): One-page bookmark reference for the YAML shape, common patterns, and top gotchas.
- [Step type index](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/step-types): Alphabetical catalog of every step type.
- [Context variables](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/context-variables): Every variable you can reference in a Liquid expression.
- [Liquid filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6826/explore-analyze/workflows/reference/liquid-filters): Filters available in workflow expressions.