@elastic

elasticsearch-authn covers authentication to Elasticsearch clusters across all built-in and external realms (native, file, LDAP, AD, PKI, SAML, OIDC, JWT, Kerberos) and the full API key lifecycle, with explicit deployment compatibility constraints.

elasticsearch-file-ingest streams large data files (ndjson, csv, parquet, arrow ipc) into elasticsearch with custom javascript transforms, supporting batch processing and document splitting at 50k+ docs/second throughput.

observability-logs-search guides iterative log filtering via es|ql to isolate root cause or anomaly. uses a funnel workflow (broad scope, exclude noise, repeat) with histogram, samples, and message categorization until fewer than 20 distinct patterns remain.

elasticsearch-authz covers native user creation, role-based access control, document and field-level security, and role mapping for external realms across self-managed, ech, and serverless deployments.

kibana-vega enables creation and layout of custom Kibana dashboards using Vega visualizations with ES|QL data sources. provides cli-driven workflow for visualization management, grid-based dashboard design, and common pitfall avoidance.

generates ecs-compliant security events, attack scenarios, and synthetic alerts for populating elastic security dashboards. supports continuous streaming, selective data generation by package type, and tagged cleanup.

elasticsearch-esql covers execution of ES|QL queries against Elasticsearch clusters, with schema discovery, time series support, full-text search, and advanced features like change point detection and data enrichment via lookup joins.

setup guide for deploying elastic opentelemetry java agent with required environment variables and javaagent attachment configuration, avoiding common mistakes like apm server endpoints and dual agent conflicts.

cloud-manage-project wraps elastic cloud serverless rest api for day-2 operations. covers prerequisites, permission requirements, and authorization failure recovery, but lacks concrete procedural steps.

elasticsearch-security-troubleshooting describes diagnostic triage for authentication, authorization, and tls failures but lacks concrete procedural steps, decision trees, or outcome measurement criteria.

kibana-connectors documents connector types across seven categories (llm, incident management, endpoint security, messaging, logging, webhook, elastic) and explains their role in routing alerting actions within kibana spaces.

kibana-streams covers read-only stream metadata, settings, queries, and lifecycle operations (enable, disable, resync) via the experimental kibana streams rest api. mutating operations not yet supported.

kibana-agent-builder manages agent lifecycle operations (create, update, delete, inspect, chat) and custom tools in kibana, requiring environment configuration for api authentication.

security-detection-rule-management provides tooling for creating and tuning kibana detection engine rules via rule-manager.js, targeting threat coverage gaps and false positive reduction.

kibana-audit documents what kibana audit logging covers (saved object changes, login events, session management, rbac enforcement) but lacks actionable configuration steps or implementation details.

cloud-access-management provides primitives for user provisioning and role assignment within elastic cloud organizations, but lacks executable procedure and concrete decision logic.

elasticsearch-audit documents security event logging in elasticsearch clusters. actual configuration steps, trigger conditions, and operational guidance are absent.

cloud-network-security defines prerequisites and scope for managing network policies on elastic cloud serverless projects via ip and vpc filters, but lacks procedural steps, trigger phrases, and failure handling.

observability-service-health outlines data sources and metrics for apm health assessment but lacks actionable procedure, decision logic, or recovery paths. reads as a requirements sketch rather than executable skill.

observability-edot-dotnet-instrument references external setup documentation but provides no actionable procedure, decision logic, or success criteria within the skill itself.

observability-edot-java-migrate references external migration documentation without providing actionable steps, intent clarity, or decision criteria for migrating java observability to edot.

observability-edot-python-migrate provides skeleton references to migration documentation but lacks actionable procedure, decision logic, or outcome validation for actual migration execution.

Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or…

Help developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and…

Create and manage Kibana Dashboards and visualizations. Use when you need to define dashboards and visualizations declaratively, version control them, or…

Create and manage Kibana alerting rules via REST API or Terraform. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze) or…

>

>

>

>

>

>

>