| navigation_title | Observability | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| applies_to |
|
||||||||||||||||||
| description | Use workflows to respond to anomaly detection alerts, correlate signals across data sources, and automate scheduled data operations in Elastic Observability. | ||||||||||||||||||
| products |
|
Observability signals (infrastructure metrics, application logs, traces, and anomaly detection results) generate the same kind of "observe a problem, do something about it" loop that security does. Use workflows to close that loop: correlate signals across sources, route to the right team, and run scheduled maintenance or reporting tasks.
The following patterns use existing workflow capabilities:
- Respond to anomaly detection alerts. Configure an alert trigger on an anomaly detection rule. The workflow runs with the alert's context, and can query log data in a window around the anomaly, enrich with host or service metadata, and open a case or post a notification.
- Correlate signals across data sources. Use {{es}} search actions to query metrics, logs, and traces in the same workflow, then combine results with
ifsteps to decide on next actions. Use data action steps to filter, group, and remove duplicate results before acting on them. - Automate scheduled data operations. Use a scheduled trigger to run periodic health checks, index rollover tasks, or data quality audits.
- Analyze signals with AI. Use AI steps to summarize a multi-signal investigation with
ai.summarize, classify anomaly shapes withai.classify, or invoke an {{agent-builder}} agent withai.agentbefore the workflow takes action. - Operate on Observability Streams. Use Streams action steps to list available streams and pull significant events into a workflow for further processing.
Step-by-step guides for observability workflows:
- Automate root cause analysis for an observability alert: Run an {{agent-builder}} agent on an alert, then open a case populated with the agent-generated analysis and reasoning trace.
- Alert triggers: Use anomaly detection or alerting rules to invoke a workflow.
- Scheduled triggers: Run a workflow on a fixed schedule.
- Event-driven triggers: React when another workflow fails.
- {{es}} action steps: Reference for search, index, and request actions.
- Streams action steps: Observability Streams operations (technical preview).
- Data action steps: Filter, aggregate, and transform signal data inside a workflow.
- {{agent-builder}} for Observability: How Agent Builder integrates with observability workflows.