# Elasticsearch: Search Logs

Run a search against your Elasticsearch cluster


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

The action runs a search against the **Index Pattern** you specify using **Lucene**, **KQL**, **EQL**, or **Query DSL**, and returns up to **Max Results** documents (allowed range **1–1000**; default **100**). Use it to pull logs or events from Elasticsearch while you investigate or automate around an incident.

PagerDuty does _not_ inject a default time range. For time-bounded results, include time constraints in your query (for example in Query DSL with a `range` filter on `@timestamp`) or as supported by your query type and index mappings.

### Prerequisites

- An Elasticsearch cluster reachable from PagerDuty over HTTPS (compatible with Elasticsearch 7.x or 8.x; confirm with your administrator).
- An Elasticsearch **API key** with permission for connection validation and for searching your index patterns.
- An Elasticsearch connection in PagerDuty. See the [Elasticsearch subsection in Workflow Integrations ](/ai-automation/automation/incident-workflows/workflow-integrations#elasticsearch).

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

<br />

| Name                 | Description                                                                                                                                                                                                                                                                                                                                                                                               |
| :------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Connection Input** | The Elasticsearch Workflow Integration connection (Elasticsearch URL and API Key configured in PagerDuty). If you have not yet configured a Elasticsearch integration, please see the [Elasticsearch Integration](/ai-automation/automation/incident-workflows/workflow-integrations#elasticsearch) instructions. |
| **Index Pattern**    | Index pattern to search (for example `logs-*`, `filebeat-*`, `logstash-*`). This value is used in the request path to Elasticsearch.                                                                                                                                                                                                                                                                      |
| **Query Type**       | Lucene (default), KQL, EQL, or Query DSL. See Query types below.                                                                                                                                                                                                                                                                                                                                          |
| **Query**            | The search string or JSON for the selected query type.                                                                                                                                                                                                                                                                                                                                                    |
| **Max Results**      | Maximum number of documents to return. Allowed range: **1–1000**. Default: **100**.                                                                                                                                                                                                                                                                                                                       |

> **Query Types**
>
> **Lucene** — Sent to Elasticsearch `_search` using a `query_string` query with your **Query** text.
>
> **KQL** — Sent to `_search` using a `query_string` query with **lenient** parsing and default operator **AND**. KQL and Lucene are not identical; verify results against your data.
>
> **EQL** — Sent to `_eql/search` with your **Query** as the EQL expression and **Max Results** as the request size.
>
> **Query DSL** — **Query** must be valid JSON for the **inner** query object only (not the full request body). PagerDuty wraps it as `{ "query": <your JSON>, "size": <Max Results> }` and sends it to `_search`. Invalid JSON produces an error.

## Outputs

| Name                   | Description                                                                                                                                                               |
| :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Logs**               | JSON array of matching documents (fields such as `_index`, `_id`, `_source`, and a derived `timestamp` when present). Empty array if the search fails or returns no hits. |
| **Log Count**          | Number of documents in Logs for this response.                                                                                                                            |
| **Query Used**         | The Query input as processed for the action.                                                                                                                              |
| **Index Pattern Used** | The Index Pattern that was searched.                                                                                                                                      |
| **Total Hits**         | Total matching documents reported by Elasticsearch (may exceed **Log Count** when limited by **Max Results**).                                                            |
| **Search Duration**    | Query execution time as reported by Elasticsearch (for example `42ms`).                                                                                                   |
| **Result**             | **Success** or **Failed**.                                                                                                                                                |
| **Result Summary**     | Brief description of what the action did or if it failed. Example: "Successfully retrieved 42 logs."                                                                      |
| **Error**              | Populated when the action fails (for example authentication, index not found, or invalid Query DSL).                                                                      |

<br />