---
title: Observability workflows
description: Use workflows to respond to anomaly detection alerts, correlate signals across data sources, and automate scheduled data operations in Elastic Observability.
url: https://www.elastic.co/docs/explore-analyze/workflows/use-cases/observability
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Stack
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.4, Preview in 9.3
---

# Observability workflows
Observability signals (infrastructure metrics, application logs, traces, and anomaly detection results) generate the same kind of "observe a problem, do something about it" loop that security does. Use workflows to close that loop: correlate signals across sources, route to the right team, and run scheduled maintenance or reporting tasks.

## What you can automate

The following patterns use existing workflow capabilities:
- **Respond to anomaly detection alerts.** Configure an [alert trigger](https://www.elastic.co/docs/explore-analyze/workflows/triggers/alert-triggers) on an anomaly detection rule. The workflow runs with the alert's context, and can query log data in a window around the anomaly, enrich with host or service metadata, and open a case or post a notification.
- **Correlate signals across data sources.** Use [Elasticsearch search actions](https://www.elastic.co/docs/explore-analyze/workflows/steps/elasticsearch) to query metrics, logs, and traces in the same workflow, then combine results with [`if` steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/if) to decide on next actions. Use [data action steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/data) to filter, group, and remove duplicate results before acting on them.
- **Automate scheduled data operations.** Use a [scheduled trigger](https://www.elastic.co/docs/explore-analyze/workflows/triggers/scheduled-triggers) to run periodic health checks, index rollover tasks, or data quality audits.
- **Analyze signals with AI.** Use [AI steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/ai-steps) to summarize a multi-signal investigation with `ai.summarize`, classify anomaly shapes with `ai.classify`, or invoke an Elastic Agent Builder agent with `ai.agent` before the workflow takes action.
- **Operate on Observability Streams.** Use [Streams action steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/streams) to list available streams and pull significant events into a workflow for further processing.


## How-to guides

Step-by-step guides for observability workflows:
- [Automate root cause analysis for an observability alert](https://www.elastic.co/docs/explore-analyze/workflows/use-cases/observability/root-cause-analysis): Run an Elastic Agent Builder agent on an alert, then open a case populated with the agent-generated analysis and reasoning trace.


## Learn more

- [Alert triggers](https://www.elastic.co/docs/explore-analyze/workflows/triggers/alert-triggers): Use anomaly detection or alerting rules to invoke a workflow.
- [Scheduled triggers](https://www.elastic.co/docs/explore-analyze/workflows/triggers/scheduled-triggers): Run a workflow on a fixed schedule.
- [Event-driven triggers](https://www.elastic.co/docs/explore-analyze/workflows/triggers/event-driven-triggers): React when another workflow fails.
- [Elasticsearch action steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/elasticsearch): Reference for search, index, and request actions.
- [Streams action steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/streams): Observability Streams operations (technical preview).
- [Data action steps](https://www.elastic.co/docs/explore-analyze/workflows/steps/data): Filter, aggregate, and transform signal data inside a workflow.
- [Elastic Agent Builder for Observability](https://www.elastic.co/docs/solutions/observability/ai/agent-builder-observability): How Agent Builder integrates with observability workflows.