---
title: Context variables
description: Every context variable you can reference in a Liquid expression inside a workflow, with an example for each.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/reference/context-variables
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Stack
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.4, Preview in 9.3
---

# Context variables
Context variables are the data you can reference inside [Liquid expressions](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/templating) in a workflow. Every execution gets the same core set. Some variables are only populated in certain contexts (for example, `foreach.item` exists only inside a `foreach` loop).
This page is the canonical reference. For the mental model and the `{{ }}` vs. `${{ }}` distinction, refer to [Templating engine](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/templating).

## Core variables


### `inputs.<name>`

Values provided at workflow invocation time. Declared in the workflow's top-level `inputs` block.
```yaml
inputs:
  - name: service_name
    type: string
    required: true

steps:
  - name: search
    type: elasticsearch.esql.query
    with:
      query: "FROM logs-* | WHERE service.name == \"{{ inputs.service_name }}\""
```


### `consts.<name>`

Constants declared at the top of the workflow. Evaluated once at workflow load. They can't reference other context (no `inputs`, no `steps`).
```yaml
consts:
  threshold: 70
  slack_channel: "#soc-oncall"

steps:
  - name: notify
    type: slack.postMessage
    with:
      channel: "{{ consts.slack_channel }}"
      text: "Threshold {{ consts.threshold }} exceeded."
```


### `steps.<name>.output`

The output produced by a previous step. Shape depends on the step type. Refer to each step's reference for what it returns.
```yaml
steps:
  - name: search
    type: elasticsearch.search
    with: { index: "logs-*", size: 1 }

  - name: summarize
    type: console
    with:
      message: "First hit: {{ steps.search.output.hits.hits[0]._id }}"
```


### `steps.<name>.error`

Error details if the step failed and its `on-failure: continue` caught the error. `null` if the step succeeded. Refer to [Pass data and handle errors](/elastic/docs-content/tree/main/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors#workflows-on-failure-continue) for the `continue` strategy.
```yaml
- name: flaky_call
  type: http
  on-failure:
    continue: true
  with: { url: "https://flaky.example" }

- name: handle
  type: if
  condition: "steps.flaky_call.error : null"
  steps: [ ... ]    
  else:  [ ... ]    
```


## Trigger-provided variables


### `event.*`

The trigger payload. Shape depends on the trigger type:

| Trigger            | `event.*` structure                                                                                                                                                                               |
|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `manual`           | `{}` (empty — use `inputs.*` instead)                                                                                                                                                             |
| `scheduled`        | `{}` (empty)                                                                                                                                                                                      |
| `alert`            | `event.alerts` (array of alert documents), `event.rule` (rule metadata), `event.spaceId`, `event.params.*` (params from the rule's action configuration)                                          |
| `workflows.failed` | `event.spaceId`, `event.timestamp`, `event.workflow.{id, name, spaceId, isErrorHandler}`, `event.execution.{id, startedAt, failedAt}`, `event.error.{message, stepId, stepName, stepExecutionId}` |

For the full `workflows.failed` payload, refer to [Event-driven triggers](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/triggers/event-driven-triggers).
Alert trigger example:
```yaml
- name: log
  type: console
  with:
    message: |
      Got {{ event.alerts | size }} alerts from rule "{{ event.rule.name }}".
      First host: {{ event.alerts[0].host.name }}
```


### `execution.*`

Metadata about the current workflow execution.

| Field                        | Contains                                                                                                                                                                         |
|------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `execution.id`               | Execution ID.                                                                                                                                                                    |
| `execution.startedAt`        | ISO timestamp of start.                                                                                                                                                          |
| `execution.isTestRun`        | `true` if run from the editor's **Test** button.                                                                                                                                 |
| `execution.executedBy`       | UID of the user or system that invoked the workflow.                                                                                                                             |
| `execution.triggeredBy`      | Which trigger initiated this execution (`manual`, `scheduled`, `alert`, `workflows.failed`).                                                                                     |
| `execution.url`              | Deep link to the execution view in Kibana.                                                                                                                                       |
| `execution.compositionDepth` | 0 for a top-level invocation. Increments by 1 for each [`workflow.execute`](/elastic/docs-content/tree/main/explore-analyze/workflows/steps/composition#workflow-execute) level. |
| `execution.parentWorkflowId` | ID of the parent workflow, if this is a composed child execution.                                                                                                                |

```yaml
- name: link
  type: console
  with:
    message: "View this execution: {{ execution.url }}"
```


### `workflow.*`

Metadata about the workflow itself, not the execution.

| Field              | Contains             |
|--------------------|----------------------|
| `workflow.id`      | Workflow ID.         |
| `workflow.name`    | Workflow name.       |
| `workflow.enabled` | `true` or `false`.   |
| `workflow.spaceId` | The Kibana space ID. |

```yaml
- name: audit
  type: elasticsearch.index
  with:
    index: "workflow-audit"
    document:
      workflow_id:   "{{ workflow.id }}"
      workflow_name: "{{ workflow.name }}"
      space_id:      "{{ workflow.spaceId }}"
      execution_id:  "{{ execution.id }}"
```


## Loop-local variables


### `foreach.*`

Available inside a [`foreach`](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/steps/foreach) loop body.

| Field           | Contains                       |
|-----------------|--------------------------------|
| `foreach.item`  | Current iteration's element.   |
| `foreach.index` | Zero-based iteration index.    |
| `foreach.total` | Total items in the array.      |
| `foreach.items` | The full array being iterated. |

```yaml
- name: process
  foreach: "${{ event.alerts }}"
  steps:
    - name: log
      type: console
      with:
        message: "[{{ foreach.index }}/{{ foreach.total }}] {{ foreach.item._id }}"
```


### `while.iteration`

Available inside a [`while`](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/steps/while) loop body. Zero-based iteration counter.
```yaml
- name: poll
  type: while
  condition: "steps.check.output.status : 'pending'"
  max-iterations: 30
  steps:
    - name: log
      type: console
      with: { message: "Attempt {{ while.iteration }}" }
    - name: check
      type: elasticsearch.search
      with: { index: "jobs", size: 1 }
    - name: wait
      type: wait
      with: { duration: "2s" }
```


## User-defined variables


### `variables.<name>`

Variables set by one or more [`data.set`](/elastic/docs-content/tree/main/explore-analyze/workflows/steps/data#data-set) steps. Global within the workflow execution. Later `data.set` steps can overwrite earlier values.
```yaml
- name: init
  type: data.set
  with:
    service: "checkout"
    region: "us-east"

- name: query
  type: elasticsearch.esql.query
  with:
    query: "FROM logs-{{ variables.region }}-* | WHERE service.name == \"{{ variables.service }}\""
```


## Standard helpers


### `now`

Current timestamp as an ISO 8601 string. Evaluated per reference, so repeated uses in the same expression will match.
```yaml
- name: index_row
  type: elasticsearch.index
  with:
    index: "events"
    document:
      at: "{{ now }}"
      formatted: "{{ now | date: '%Y-%m-%d %H:%M' }}"
```


### `kibanaUrl`

Base URL of the Kibana instance. Useful for building deep links in notifications.
```yaml
- name: notify
  type: slack.postMessage
  with:
    channel: "#soc"
    text: |
      Case created: <{{ kibanaUrl }}/app/security/cases/{{ steps.create_case.output.id }}|Open in {{kib}}>
```


## Related

- [Templating engine](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/templating): How Liquid expressions evaluate these variables.
- [Liquid filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/reference/liquid-filters): Transformations you can apply to any variable.
- [Cheat sheet](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/reference/cheat-sheet): The condensed version of this table.
- [Steps overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/steps): Each step's reference documents what its `output` contains.