Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Indexer → Query
AI-generatedSummary
Execute an arbitrary OpenSearch query against the specified Wazuh Indexer index or index pattern and return the search results.
Inputs
- Method — HTTP method (GET or POST) to use for the index _search request; defaults to POST.
- Index Pattern (required) — Name or pattern of the Wazuh Indexer index to query, e.g., 'wazuh-alerts*'.
- Query JSON (required) — The OpenSearch query DSL JSON body sent to the index _search endpoint; defaults to a match_all query.
Output shape
a JSON object representing the search results from the Wazuh Indexer API
The output includes normalized fields such as items (containing hits with index, id, score, source, etc.), total count of hits, and other metadata like took and shards. If the response body contains hits, these are normalized to a structured format; otherwise, the raw response body is returned.