Doubt about Elasticsearch node

Apply custom queries to the ELK Node

Hello, my name is Robert, I’m a Cybersecurity Incident Responder.

I came accross n8n while reading a Tutorial about another Tool that I’m using and has integration with n8n (The Hive), and I really liked what I read, and decided to try n8n.
Before I installed n8n, I read part of the Docs and watch some Youtube videos, which lead me to believe that n8n definitely has the potential to be very useful on my environment.

Currently, I’m using an ELK instance where I store some alert types and I would like to create the following Workflow:

  1. Start (Later I would change this for the Cron Trigger)
  2. Use the ELK Node (To Pull All docs created within the last X minutes from an index)
  3. Continue the Orchestration using other nodes

I would like to know how can I configure the ELK node with custom ELK Queries (e.g. {“query”: { “range”: { “created_at”: { “gte”: “now-1h” } }}})

If this is not possible at the moment, I would like to know if this can become a Feature Request.

Kind regards,
Rob

Information about the n8n setup:

  • n8n version:
  • Database: SQLite
  • Running n8n with the execution process: own(default)
  • Running n8n via: Docker

Hi @robjennings, welcome to the community :tada:

You can use queries on the Elasticsearch node (using the Get All operation of the node), but this is hidden behind the Add Option button:

1 Like

Hello @MutedJam,

Thank you very much for such a quick response.

I browsed through the Options but somehow I missed the “Query” option, my bad.

I’ve tried it and it works really well.

Kind regards,
Rob

1 Like

Excellent, glad to hear this works for you!