Search workflow executions Generally available

GET /api/workflows/workflow/executions
Api key auth

Spaces method and path for this operation:

get /s/{space_id}/api/workflows/workflow/executions

Refer to Spaces for more information.

Search across all workflow executions.

[Required authorization] Route required privileges: workflowsManagement:readExecution OR workflowsManagement:managed:readExecution.

Query parameters

  • kql string

    KQL query string to filter executions.

    Maximum length is 4096.

  • statuses array[string]

    Filter by execution status.

    Not more than 11 elements. Values are pending, waiting, waiting_for_input, waiting_for_child, running, queued, completed, failed, cancelled, timed_out, or skipped.

  • executionTypes array[string]

    Filter by execution type.

    Not more than 2 elements. Values are test or production.

  • executedBy array[string]

    Filter by the user who triggered the execution.

    Not more than 100 elements.

  • concurrencyGroupKey string

    Filter by evaluated concurrency group key.

  • startedAfter string

    Datemath lower bound for filtering executions by startedAt.

  • startedBefore string

    Datemath upper bound for filtering executions by startedAt.

  • finishedAfter string

    Datemath lower bound for filtering executions by finishedAt.

  • finishedBefore string

    Datemath upper bound for filtering executions by finishedAt.

  • collapse string

    Field to collapse execution results by.

    Values are concurrencyGroupKey, status, executedBy, or triggeredBy.

  • sortField string

    Field to sort by. One of: startedAt, duration, workflowId, triggeredBy.

    Values are startedAt, duration, workflowId, or triggeredBy.

  • sortOrder string

    Sort direction.

    Values are asc or desc.

  • page number

    Page number.

    Minimum value is 1.

  • size number

    Number of results to return.

    Minimum value is 1, maximum value is 100.

  • trackTotalHits boolean

    Whether to track total hit count.

Responses

  • 200 application/json

    Indicates a successful response

  • 400 application/json

    Indicates a bad request, such as invalid KQL syntax

GET /api/workflows/workflow/executions 
curl \
  -X GET "${KIBANA_URL}/api/workflows/workflow/executions?page=1&size=25&trackTotalHits=true&kql=startedAt%20%3E%3D%20%22now-15m%22&sortField=startedAt&sortOrder=desc" \
  -H "Authorization: ApiKey ${API_KEY}"

GET kbn://api/workflows/workflow/executions?from=0&size=25&trackTotalHits=true&kql=startedAt >= "now-15m"&sortField=startedAt&sortOrder=desc
Response examples (200)
Example paginated list of workflow-level executions 
{
  "page": 1,
  "results": [
    {
      "duration": 3000,
      "error": null,
      "executedBy": "elastic",
      "finishedAt": "2025-11-20T12:00:03.000Z",
      "id": "exec-a1b2c3d4-e5f6-7890",
      "isTestRun": false,
      "managed": false,
      "spaceId": "default",
      "startedAt": "2025-11-20T12:00:00.000Z",
      "status": "completed",
      "tags": [
        "reporting"
      ],
      "triggeredBy": "manual",
      "workflowId": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "workflowName": "Example Workflow"
    }
  ],
  "size": 25,
  "total": 1
}
Response examples (400)
Example response when the kql parameter contains invalid syntax 
{
  "message": "Invalid KQL: Expected AND, OR, or end of input but \"f\" found."
}