search_events
Read-only
Search for events in a Prisme.ai workspace using Elasticsearch DSL queries. Filter by event type, automation, correlation ID, or other fields to find specific events.
Instructions
Search for events in Prisme.ai workspace using Elasticsearch DSL.
EVENT STRUCTURE:
Events contain the following key fields:
- @timestamp: Event timestamp (ISO 8601 format) - USE THIS FOR SORTING, NOT "timestamp"
- id: Unique event ID
- type: Event type (e.g., "runtime.automations.executed", "workspaces.pages.updated", "error")
- source: Metadata object containing:
- correlationId: Groups all events from a single API request/operation
- userId: User who triggered the event
- sessionId: User session identifier
- workspaceId: Workspace identifier
- automationSlug: Automation name (for automation-related events)
- http: HTTP request details (method, path, hostname, ip)
- host: Service information (replica, service name)
- payload: Event-specific data (varies by event type)
- createdAt: Creation timestamp
COMMON QUERIES:
- Find all events for a specific request: {"bool": {"filter": [{"term": {"source.correlationId": "uuid-here"}}]}}
- Find automation executions: {"bool": {"filter": [{"term": {"type": "runtime.automations.executed"}}]}}
- Find events for specific automation: {"bool": {"filter": [{"term": {"source.automationSlug": "automation-name"}}]}}
- Find errors: {"bool": {"filter": [{"term": {"type": "error"}}]}}
- Exclude specific correlationId: {"bool": {"must_not": [{"term": {"source.correlationId": "uuid-here"}}]}}
SORTING:
- Always use "@timestamp" field for time-based sorting: [{"@timestamp": {"order": "desc"}}]
- DO NOT use "timestamp" as it's not mapped in the index
COMMON EVENT TYPES:
- runtime.automations.executed
- runtime.interactions.triggered
- runtime.dsul.updated
- workspaces.automations.created/updated/deleted
- workspaces.pages.created/updated/deleted
- error
ADDITIONAL INFO:
- SearchError are probably caused by your own previous failed attempt to create filters. This is usually not the event the user ask for. Keep searching for the events before the SearchError ones.
- Always use "source" to filter only the necessary fields. Only include the informations that are relevant to the user's request. Ignore durations, timestamps, IP adress if not asked for.
Supports full Elasticsearch DSL query syntax including aggregations, sorting, and pagination.Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| aggs | No | Elasticsearch aggregations to execute on the results (e.g., count by type, group by correlationId) | |
| page | No | Page number (1-indexed) | |
| sort | No | Elasticsearch sort criteria. IMPORTANT: Use "@timestamp" not "timestamp" for time-based sorting. Example: [{"@timestamp": {"order": "desc"}}] | |
| limit | No | Page size (number of documents to return, default varies by API) | |
| query | Yes | Elasticsearch DSL query object (e.g., {"match_all": {}} or {"bool": {"filter": [{"term": {"type": "event_name"}}]}}) | |
| source | No | Fields to include in the response. Omit to get all fields. Example: ["correlationId", "@timestamp", "type", "source.automationSlug", "payload"] | |
| environment | No | Optional environment name (from PRISME_ENVIRONMENTS) to use specific API URL and workspace | |
| workspaceId | No | Alternative: direct workspace ID (use workspaceName instead when possible) | |
| workspaceName | Yes | Workspace name that resolves to ID via PRISME_WORKSPACES or PRISME_ENVIRONMENTS mapping | |
| track_total_hits | No | Get real total count instead of capped at 10000 (may impact performance) |