What is looping?

When you're building workflows in Tines, you often receive data as arrays. Maybe an API returns 50 user accounts, or a security tool sends 100 alerts, or you need to process 20 files from an email attachment. Instead of handling each item manually, Tines gives you looping: a way to automatically process every element in an array through the same logic.

Looping is a way to scale your workflows. It lets you take one piece of logic and apply it to  array items without building separate branches for each one. Looping in Tines means processing each element in an array individually, applying the same action or transformation to every item. Think of it like an assembly line: you define what should happen to each item, and Tines runs every item through that process automatically.

When you loop, Tines takes an array like this:

["alert-001", "alert-002", "alert-003"]

and processes each element one at a time, letting you transform, enrich, or act on each item individually.

Why looping matters 

• Looping handles real-world data: APIs rarely return single items. They return arrays of users, lists of incidents, collections of logs. Looping lets you process all of them without manual intervention.

• Looping scales your logic: Write your transformation or enrichment logic once, and Tines applies it to every item in your array; whether that's 5 items or 5,000.

• Looping keeps workflows clean: Instead of creating dozens of parallel branches or nested actions, looping processes everything in a single, readable flow.

• Looping enables aggregation: After processing each item individually, you can collect the results back into a single array for downstream actions.

How looping works 

Tines provides looping through the Event Transform action in message only mode and through action groups. Both let you specify an array to loop over and define what should happen to each element.

When you configure looping, you:

1. Specify the array you want to loop over (using a formula reference to upstream data).

2. Define what should happen to each element (your transformation logic).

3. Receive the results as an aggregated array in a single output event.

During each loop iteration, Tines provides you with a LOOP object that contains:

• LOOP.value - The current element being processed.

• LOOP.index - The position of the current element in the array (starting from 0).

• LOOP.key - When looping over objects (key-value pairs), this is the current key.

For example, if you're looping over ["alert-001", "alert-002", "alert-003"]:

• On the first iteration: LOOP.value = "alert-001", LOOP.index = 0

• On the second iteration: LOOP.value = "alert-002", LOOP.index = 1

• On the third iteration: LOOP.value = "alert-003", LOOP.index = 2

Loop with Event Transform 

The most common way to loop in Tines is using an Event Transform action in message only mode with the loop option configured.

🖐️ Try this: Configure a loop with Event Transform 

Loop with action groups 

Action groups also support looping. When you configure a group with the loop option, Tines invokes the entire group for each element in your array.

This is powerful when you need to perform multiple actions on each item; like enriching an IP address by querying threat intelligence, checking a blocklist, and logging the result.

By default, groups process loops serially (one after another) to preserve the order of your array. You can enable parallel looping for better performance, but this doesn't guarantee the order of results.