Reference · Tools

Elasticsearch

Interact with Elasticsearch documents and indices using the Elasticsearch API.

Action Data & Storage v1

The Elasticsearch node gives you full CRUD access to your Elasticsearch documents and indices directly inside a BusyBot workflow. Use it to index incoming webhook data, search documents and route results downstream, or bulk-load records from another data source into an index. Both document-level operations (create, get, update, delete, search) and index-level operations (create, delete, list) are covered in a single node.

Node type
Action
Parameters
34
Outputs
Output, Error
Credentials
Elasticsearch API

Elasticsearch

Create, search, update, and delete Elasticsearch documents and indices.

Overview

Elasticsearch tool provides full CRUD access to Elasticsearch documents and indices. Document operations: create (with auto-ID or explicit ID), delete, get, getAll (search), update. Index operations: create, delete, get, getAll (list all indices via _aliases). Bulk mode available for document create/update/delete — flushes every 50 items using NDJSON /_bulk endpoint. getAll with returnAll=true and a sort field uses point-in-time (PIT) + search_after pagination to page beyond 10,000 hits. getAll without sort uses a single request with size=10000. simple=true flattens _source fields to the top level. Auth: HTTP Basic Auth on every request using username + password from the elasticsearchApi credential.

Category: Data & Storage
Tool Name: elasticsearch
Version: 1

Appearance: Icon: lucide-Search | Color: #FEC514

Node Type

Action — processes input items and produces output

Input / Output

DirectionPort(s)
InputInput
OutputOutput, Error

Credentials

This tool requires Elasticsearch API credentials. See the Credentials Guide for setup instructions.

Resources

ResourceValue
Documentdocument
Indexindex

Operations

OperationValueDescription
CreatecreateCreate a document or index.
DeletedeleteDelete a document or index.
GetgetGet a document or index.
Get ManygetAllGet many documents or indices.
UpdateupdateUpdate a document. Available for the document resource only.

Parameters

Document: Create

ParameterTypeRequiredDefaultDescription
Index IDstringYesID of the index to add the document to.
Data to SendoptionsNodefineBelowHow to send data to Elasticsearch.
Options: defineBelow (set the value for each destination field), autoMapInputData (use when node input properties match destination field names)
Inputs to IgnorestringNoComma-separated list of input properties to skip. Leave empty to send all properties. (shown when Data to Send is autoMapInputData)
Fields to SendfixedCollectionNo{}The document fields to write, one row per field. (shown when Data to Send is defineBelow)
— Field NamestringNoThe document field name.
— Field ValuestringNoThe value to store in that field.
Additional FieldscollectionNo{}Optional settings for the write.
— Document IDstringNoID to assign to the document. If omitted, Elasticsearch auto-generates one.
— RoutingstringNoTarget primary shard.
— TimeoutstringNo1mPeriod to wait for active shards.
OptionscollectionNo{}Request behavior.
— Bulk CreatebooleanNofalseWhether to use the bulk operation to create documents.
— Pipeline IDstringNoID of the pipeline to use to preprocess incoming documents.
— RefreshoptionsNofalseRefresh behavior after the operation.
Options: true, wait_for, false

Document: Delete

ParameterTypeRequiredDefaultDescription
Index IDstringYesID of the index containing the document to delete.
Document IDstringYesID of the document to delete.
OptionscollectionNo{}Request behavior.
— Bulk DeletebooleanNofalseWhether to use the bulk operation to delete the document.
— RefreshoptionsNofalseRefresh behavior for the delete operation.
Options: true, wait_for, false
— RoutingstringNoTarget primary shard.

Document: Get

ParameterTypeRequiredDefaultDescription
Index IDstringYesID of the index containing the document to retrieve.
Document IDstringYesID of the document to retrieve.
SimplifybooleanNotrueWhether to return a simplified version of the response with _source fields at the top level.
OptionscollectionNo{}Which parts of the document to return.
— Source ExcludesstringNoComma-separated list of source fields to exclude from the response.
— Source IncludesstringNoComma-separated list of source fields to include in the response.
— Stored FieldsbooleanNofalseWhether to retrieve fields stored in the index rather than _source.

Document: Get Many

ParameterTypeRequiredDefaultDescription
Index IDstringYesID of the index to search.
Return AllbooleanNofalseWhether to return all results or only up to a given limit.
LimitnumberNo50Max number of results to return. (shown when Return All is false)
SimplifybooleanNotrueWhether to return simplified documents with _source fields at the top level.
OptionscollectionNo{}Query, sorting and search behavior.
— QuerystringNoElasticsearch Query DSL as a JSON string. Example: {“match_all”:{}}
— SortstringNoComma-separated field:direction pairs. When set with returnAll=true, PIT pagination is used.
— Source ExcludesstringNoComma-separated list of source fields to exclude.
— Source IncludesstringNoComma-separated list of source fields to include.
— Allow No IndicesbooleanNotrueWhether to allow no matching indices.
— Allow Partial Search ResultsbooleanNotrueWhether to return partial results on shard failures.
— ExplainbooleanNofalseWhether to return score computation detail.
— Ignore UnavailablebooleanNofalseWhether to ignore missing or closed indices.
— RoutingstringNoTarget primary shard.
— Search TypeoptionsNoquery_then_fetchHow distributed term frequencies are calculated.
Options: query_then_fetch, dfs_query_then_fetch
— TimeoutstringNo1mPeriod to wait for active shards.
— Track Total HitsnumberNo10000Number of hits to count accurately.
— VersionbooleanNofalseWhether to return document version as part of a hit.

Document: Update

ParameterTypeRequiredDefaultDescription
Index IDstringYesID of the index containing the document to update.
Document IDstringYesID of the document to update.
Data to SendoptionsNodefineBelowHow to send data to Elasticsearch.
Options: defineBelow, autoMapInputData
Inputs to IgnorestringNoComma-separated list of input properties to skip. (shown when Data to Send is autoMapInputData)
Fields to SendfixedCollectionNo{}The document fields to change, one row per field. (shown when Data to Send is defineBelow)
— Field NamestringNoThe document field name.
— Field ValuestringNoThe value to store in that field.
OptionscollectionNo{}Request behavior.
— Bulk UpdatebooleanNofalseWhether to use the bulk operation to update documents.
— RefreshoptionsNofalseRefresh behavior after the operation.
Options: true, wait_for, false
— RoutingstringNoTarget primary shard.

Index: Create

ParameterTypeRequiredDefaultDescription
Index IDstringYesID (name) of the index to create.
Additional FieldscollectionNo{}Optional settings applied when the index is created.
— AliasesstringNoIndex aliases as a JSON object.
— MappingsstringNoField mappings for the index as a JSON object.
— SettingsstringNoConfiguration options for the index as a JSON object.
— Master TimeoutstringNo1mPeriod to wait for a connection to the master node.
— TimeoutstringNo30sPeriod to wait for a response.
— Wait for Active ShardsstringNo1Number of shard copies that must be active before proceeding.

Index: Delete

ParameterTypeRequiredDefaultDescription
Index IDstringYesID of the index to delete.

Index: Get

ParameterTypeRequiredDefaultDescription
Index IDstringYesID of the index to retrieve.
Additional FieldscollectionNo{}Optional settings for the lookup.
— Allow No IndicesbooleanNotrueWhether to allow no matching indices.
— Expand WildcardsoptionsNoallType of index that wildcard expressions can match.
Options: all, open, closed, hidden, none
— Flat SettingsbooleanNofalseWhether to return settings in flat format.
— Ignore UnavailablebooleanNofalseWhether to ignore missing indices.
— Include DefaultsbooleanNofalseWhether to return all default settings.
— LocalbooleanNofalseWhether to retrieve information from the local node only.
— Master TimeoutstringNo1mPeriod to wait for a connection to the master node.

Index: Get Many

ParameterTypeRequiredDefaultDescription
Return AllbooleanNofalseWhether to return all indices or only up to a limit.
LimitnumberNo50Max number of indices to return. (shown when Return All is false)

All Operations

ParameterTypeRequiredDefaultDescription
Max ConcurrencynumberNo5Maximum number of items to process concurrently. Accepts 1–20.

Output Data

This node replaces the item JSON rather than merging into it — the output item carries the Elasticsearch response and nothing else. Binary data on the input item is forwarded.

Resource / OperationOutput
Document createOne item per input item, carrying Elasticsearch’s index response — _index, _id, result, _version, _shards.
Document getOne item per input item, carrying the document.
Document updateOne item per input item, carrying Elasticsearch’s update response.
Document deleteOne item per input item, carrying Elasticsearch’s delete response.
Document getAllFans out — one output item per hit. A search that matches nothing produces no output items at all, so guard the branch downstream.
Index createOne item per input item, carrying id (the index name) plus the acknowledgement fields Elasticsearch returned.
Index getOne item per input item, carrying id plus that index’s aliases, mappings and settings.
Index deleteOne item per input item, carrying success: true.
Index getAllFans out — one item per index, each carrying a single indexId.

Simplify. With Simplify on (the default) each document is flattened to its _id plus the _source fields at the top level, so a hit reads like the document you stored:

{
  "_id": "MSQZ4okBLtVQ6-4lXPTd",
  "title": "Quarterly report",
  "status": "published"
}

Turn Simplify off to receive Elasticsearch’s raw hit objects, with _index, _score and the document body still nested under _source.

Bulk mode. Turning on Bulk Create, Bulk Update or Bulk Delete queues items and sends them to the _bulk endpoint in batches of 50 rather than one request per item. Each output item then carries that document’s own per-action result from the bulk response, and a document that the bulk response reports as failed is routed the same way as any other item error.

Reference results downstream by expression, e.g. {{ $json._id }} or {{ $json.indexId }}.

Usage Examples

  • Index a new document into an Elasticsearch index
  • Search documents with an Elasticsearch Query DSL filter
  • Get all documents from an index using PIT pagination
  • Update a document by ID using partial doc update
  • Delete a document by ID
  • Create an Elasticsearch index with custom mappings
  • List all available indices
  • Bulk index many documents at once

Example Configuration

Index a document with named fields:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "document",
    "operation": "create",
    "indexId": "articles",
    "dataToSend": "defineBelow",
    "fieldsUi": {
      "fieldValues": [
        { "fieldId": "title", "fieldValue": "{{ $json.title }}" },
        { "fieldId": "body", "fieldValue": "{{ $json.body }}" },
        { "fieldId": "status", "fieldValue": "published" }
      ]
    },
    "additionalFields": {
      "documentId": "{{ $json.slug }}"
    },
    "options": {
      "refresh": "wait_for"
    }
  }
}

Bulk-index every incoming item, mapping its properties straight to fields:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "document",
    "operation": "create",
    "indexId": "events",
    "dataToSend": "autoMapInputData",
    "inputsToIgnore": "_error,_metadata",
    "options": {
      "bulkOperation": true
    }
  }
}

Search with Query DSL, capped at 50 hits:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "document",
    "operation": "getAll",
    "indexId": "articles",
    "returnAll": false,
    "limit": 50,
    "simple": true,
    "options": {
      "query": "{\"match\":{\"status\":\"published\"}}",
      "_source_includes": "title,status,createdAt"
    }
  }
}

Page through an entire index — a Sort field with Return All on switches the node to point-in-time pagination, which is how you get past 10,000 hits:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "document",
    "operation": "getAll",
    "indexId": "events",
    "returnAll": true,
    "simple": true,
    "options": {
      "query": "{\"match_all\":{}}",
      "sort": "createdAt:asc",
      "track_total_hits": 100000
    }
  }
}

Read one document by ID:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "document",
    "operation": "get",
    "indexId": "articles",
    "documentId": "{{ $json.slug }}",
    "simple": true
  }
}

Partially update a document:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "document",
    "operation": "update",
    "indexId": "articles",
    "documentId": "{{ $json._id }}",
    "dataToSend": "defineBelow",
    "fieldsUi": {
      "fieldValues": [
        { "fieldId": "status", "fieldValue": "archived" }
      ]
    },
    "options": {
      "refresh": "true"
    }
  }
}

Delete a document:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "document",
    "operation": "delete",
    "indexId": "articles",
    "documentId": "{{ $json._id }}"
  }
}

Create an index with mappings and settings:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "index",
    "operation": "create",
    "indexId": "articles",
    "additionalFields": {
      "mappings": "{\"properties\":{\"title\":{\"type\":\"text\"},\"status\":{\"type\":\"keyword\"}}}",
      "settings": "{\"number_of_shards\":1,\"number_of_replicas\":1}",
      "wait_for_active_shards": "1"
    }
  }
}

List every index:

{
  "type": "elasticsearch",
  "parameters": {
    "resource": "index",
    "operation": "getAll",
    "returnAll": true
  }
}

Error Handling

ModeBehavior
stopHalts workflow on first error
continueSkips failed items, passes successful ones through
errorPortRoutes failed items to Error output port

Tips

CRUD for Elasticsearch documents and indices — search, create, update, delete, bulk operations.

Frequently asked questions

What credentials do I need to connect, and how does authentication work?

The node uses the Elasticsearch API credential type, which requires a username and password. These are sent as HTTP Basic Auth on every request the node makes. There is no API key or token-based option — you must have a user account with the appropriate privileges on your Elasticsearch cluster.

How does bulk mode work, and when should I use it?

Bulk mode is available for document create, update, and delete operations. When enabled, the node collects items and flushes them in batches of 50 using Elasticsearch's NDJSON /_bulk endpoint. Use bulk mode whenever you're processing large batches of records — it's significantly more efficient than sending one request per document.

Can I retrieve more than 10,000 documents with a search (getAll)?

Yes, but only if you specify a sort field. When returnAll is true and a sort field is provided, the node automatically uses point-in-time (PIT) pagination combined with search_after to page past Elasticsearch's 10,000-hit default limit. Without a sort field, the node sends a single request with size=10000, so results are capped there.

What does the 'simple' option do to search results?

When simple is set to true, the node flattens the _source fields up to the top level of each result object. This removes the _source wrapper so downstream nodes can reference fields like item.name instead of item._source.name, which is almost always easier to work with in a workflow.

What happens when a request fails — does the workflow stop?

The node has two separate outputs: Output for successful responses and Error for failures. This means a failed Elasticsearch request doesn't have to halt your entire workflow — you can wire the Error output to a notification step, a retry branch, or a logging action and handle it explicitly rather than letting it silently break downstream nodes.

Build with the Elasticsearch node

Drop it into a workflow, wire it to an agent, or call it on a schedule. You'll need Elasticsearch API credentials first.

Open BusyBot

Last updated . Spotted something wrong? Tell us.