Doubt about Elasticsearch node

Questions
,
1

Apply custom queries to the ELK Node

Hello, my name is Robert, I’m a Cybersecurity Incident Responder.

I came accross n8n while reading a Tutorial about another Tool that I’m using and has integration with n8n (The Hive), and I really liked what I read, and decided to try n8n.
Before I installed n8n, I read part of the Docs and watch some Youtube videos, which lead me to believe that n8n definitely has the potential to be very useful on my environment.

Currently, I’m using an ELK instance where I store some alert types and I would like to create the following Workflow:

  1. Start (Later I would change this for the Cron Trigger)
  2. Use the ELK Node (To Pull All docs created within the last X minutes from an index)
  3. Continue the Orchestration using other nodes

I would like to know how can I configure the ELK node with custom ELK Queries (e.g. {“query”: { “range”: { “created_at”: { “gte”: “now-1h” } }}})

If this is not possible at the moment, I would like to know if this can become a Feature Request.

Kind regards,
Rob

Information about the n8n setup:

  • n8n version:
  • Database: SQLite
  • Running n8n with the execution process: own(default)
  • Running n8n via: Docker
2

Hi @robjennings, welcome to the community :tada:

You can use queries on the Elasticsearch node (using the Get All operation of the node), but this is hidden behind the Add Option button:

image
image726×733 33.2 KB

1 Like
3

Hello @MutedJam,

Thank you very much for such a quick response.

I browsed through the Options but somehow I missed the “Query” option, my bad.

I’ve tried it and it works really well.

Kind regards,
Rob

1 Like
4

Excellent, glad to hear this works for you!

5

i tried to pull alert from elastic but response is empty

1
1780×529 22.6 KB

6

Hi @ahmed_mustafa, welcome to the community!

I am sorry to hear you’re having trouble here. This would suggest your query doesn’t find any results which seems to be a different issue from the one originally reported in this thread. Perhaps you could open a new topic and share an example workflow as well as an example document you’re trying to find?