Cyware Orchestrate

The following configuration parameters are required for the Elasticsearch app to communicate with the Elasticsearch deployment.

This action is used to update data in an index with a unique ID.

[
    {
        "json_data": {
            "Course": "Course Example"
        },
        "unique_id": "y0-9_YYBjrxjROvIaXOv",
        "index_name": "MyIndex1"
    }
]

This action is used to retrieve the data inside an index. The data, type, and unique ID associated with all the docs in an index are retrieved. You must have the view_index_metadata or manage index privilege for the target data stream, index, or alias.

[
    {
        "index_name": "MyIndex1"
    }
]

This action deletes the data inside an index with the unique ID.

[
    {
        "unique_id": "y0-9_YYBjrxjROvIaXOv",
        "index_name": "MyIndex1"
    }
]

This action adds the JSON data to an index and returns the associated unique ID.

[
    {
        "json_data": {
            "Course": "MyCourse"
        },
        "index_name": "MyIndex1"
    }
]

This action deletes an index. You must have the delete_index or manage index privilege for the target index. Deleting an index deletes its documents, shards, and metadata. It does not delete related Kibana components, such as data views, visualizations, or dashboards. You cannot delete the current write index of a data stream.

[
    {
        "index_name": "MyIndex"
    }
]

This action is used to search based on queries in overall indexes.

[
    {
        "query": "example index"
    }
]

This action is used to search with custom parameters passed by the user. You must have the read index privilege for the target data stream, index, or alias. This action allows you to execute a search query and get back search hits that match the query. You can provide search queries using the query string parameter.

[
    {
        "query": "Wireshark",
        "index_name": "MyIndex"
    }
]

This action creates an index with default settings. You must have the create_index or manage index privilege for the target index. To add the index to an alias, you must have the manage index privilege for the alias.

Index names must meet the following criteria:

[
    {
        "index_name": "My New Index"
    }
]

This action is used to perform multiple operations in a single API call such as insert, update, and delete. Use the Bulk Upload action, to insert multiple indexes at once. To use the index action, you must have the create, index, or write index privilege. To use the delete action, you must have the delete or write index privilege.

Action Input Parameters 

Example Request 

[
   {
      "json_data":[
         {
            "timestamp":1516729294000,
            "temperature":200,
            "voltage":5.2,
            "node":"input"
         }
      ],
      "index_name":"elastic_index"
   }
]

This action is used to perform multiple indexing operations in a single API. Use the Bulk Upload action, to insert multiple indexes instantaneously. To use the Bulk Upload action, you must have the create, index, or write index privileges.

This is a generic action to perform any additional use case on Elasticsearch.

Action Input Parameters 

Example Request 

[
   {
      "endpoint":"/_search",
      "http_method":"GET",
      "payload_json":[
         {
            "type":"malicious",
            "id":"ES4356"
         }
      ],
      "query_params":[
         {
            "page_number":6
         }
      ]
   }
]