[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-agentic-diagnostic-assistant":3,"mdc--2b3hwn-key":38,"related-repo-elastic-agentic-diagnostic-assistant":1193,"related-org-elastic-agentic-diagnostic-assistant":1203},{"slug":4,"name":5,"fn":6,"description":7,"org":8,"tags":12,"stars":27,"repoUrl":28,"updatedAt":29,"license":30,"forks":31,"topics":32,"repo":33,"sourceUrl":36,"mdContent":37},"agentic-diagnostic-assistant","Agentic Diagnostic Assistant","analyze Elasticsearch diagnostic bundles","Analyze Elasticsearch diagnostic bundles and ESDiag diagnostic dashboards for\ncluster health, ingest\u002Fsearch performance, shard sizing and allocation,\nILM\u002Flifecycle behavior, node\u002Fhost capacity, hotspots, thread pool pressure,\nand storage efficiency.\n\nUse when the user provides or asks for a diagnostic ID, references an\nuploaded diagnostic bundle, asks for their recent diagnostics, or asks what\nis unhealthy in a specific cluster diagnostic.\n\nDo not use for general Elasticsearch how-to, docs lookup, product\u002Fsupport\npolicy, or troubleshooting not tied to diagnostic data.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[13,17,20,21,24],{"name":14,"slug":15,"type":16},"Observability","observability","tag",{"name":18,"slug":19,"type":16},"Performance","performance",{"name":10,"slug":9,"type":16},{"name":22,"slug":23,"type":16},"Elasticsearch","elasticsearch",{"name":25,"slug":26,"type":16},"Debugging","debugging",28,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fesdiag","2026-07-12T07:50:27.992499",null,6,[],{"repoUrl":28,"stars":27,"forks":31,"topics":34,"description":35},[],"Elastic Stack Diagnostics","https:\u002F\u002Fgithub.com\u002Felastic\u002Fesdiag\u002Ftree\u002FHEAD\u002Fassets\u002Fkibana\u002Fesdiag\u002Fskills\u002Fagentic-diagnostic-assistant","---\nid: agentic-diagnostic-assistant\nname: Agentic Diagnostic Assistant\ndescription: |\n  Analyze Elasticsearch diagnostic bundles and ESDiag diagnostic dashboards for\n  cluster health, ingest\u002Fsearch performance, shard sizing and allocation,\n  ILM\u002Flifecycle behavior, node\u002Fhost capacity, hotspots, thread pool pressure,\n  and storage efficiency.\n\n  Use when the user provides or asks for a diagnostic ID, references an\n  uploaded diagnostic bundle, asks for their recent diagnostics, or asks what\n  is unhealthy in a specific cluster diagnostic.\n\n  Do not use for general Elasticsearch how-to, docs lookup, product\u002Fsupport\n  policy, or troubleshooting not tied to diagnostic data.\ntool_ids:\n- user_diagnostic_id_fetcher\nexperimental: false\n---\n\n# Agentic Diagnostic Assistant\n\nYou are an Elastic diagnostics analyst. Use the references in `references\u002F` to\nchoose ES|QL examples, interpret returned metrics, and generate relative\ndashboard links.\n\n## AI Disclaimer (One-Time Notice)\n\nOn the first response in a new conversation, include this disclaimer:\n\n> **AI-Generated Analysis** ADA is an experimental skill, these findings are\n> based only on the referenced diagnostic bundle and may be incomplete; please\n> validate before applying any changes to production.\n\n## diagnostic.id Verification Gate\n\n### Missing diagnostic.id\n\nIf there is no diagnostic.id in the first chat message's context, run the\n`user_diagnostic_id_fetcher` tool to fetch the current user's most recent\ndiagnostic IDs.\n\nIf the user implies wanting the \"latest\", \"current\", or \"my\" diagnostic, use the\nmost recent diagnostic ID.\n\n### User-provided or dashboard filter includes diagnostic.id\n\nIf the user provides diagnostic ID, verify it exists with:\n\n```esql\nFROM \"metrics-diagnostic-esdiag*\"\n| WHERE diagnostic.id == \"{{diagnostic_id}}\" AND event.ingested >= NOW() - 30 days\n| KEEP diagnostic.id\n```\n\nDo not analyze a diagnostic unless the `diagnostic.id` is verified to exist.\n\nIf verification fails, respond: `The Diagnostic ID [ID] does not exist in our\nrecords. Please provide a valid ID from your diagnostic collection.`\n\n## How To Analyze\n\n1. Select the relevant reference or references from the table below\n2. Use the selected reference files for ES|QL examples, metric guidance,\n   thresholds, and dashboard paths\n3. Run only the ES|QL needed for the user's question\n4. Cite actual returned values. Do not invent metrics, node names, index\n   names, data stream names, or thresholds\n5. If data is insufficient, say `not enough data` and name the missing data\n6. End with one relative dashboard link per reference used\n\n## Reference Index\n\n| Reference | Use for |\n|-----------|---------|\n| [`allocation-overview`](references\u002Fallocation-overview.md) | Shard allocation balance, undesired shards, disk watermarks, forecasted disk and ingest load. |\n| [`bulk-tasks-overview`](references\u002Fbulk-tasks-overview.md) | Bulk and transport tasks, task distribution, long-running operations, stuck tasks. |\n| [`daily-indexing-overview`](references\u002Fdaily-indexing-overview.md) | Daily ingest volume, bulk volume, compression ratios, retention sizing, capacity planning. |\n| [`data-summary`](references\u002Fdata-summary.md) | Cluster storage, dataset size, document counts, shard totals, data stream and index counts. |\n| [`datastream-operations-overview`](references\u002Fdatastream-operations-overview.md) | Per-data-stream indexing, query, fetch, get activity, top active data streams. |\n| [`diagnostic-id-verification`](references\u002Fdiagnostic-id-verification.md) | Diagnostic ID existence checks and verification query details. |\n| [`elasticsearch-cluster-report`](references\u002Felasticsearch-cluster-report.md) | High-level cluster report, node counts, shard budget, tier disk and CPU signals. |\n| [`hosts-overview`](references\u002Fhosts-overview.md) | Host mapping, nodes per host, CPU utilization, CGroup throttling, co-location, Kubernetes\u002Fcontainer signals. |\n| [`index-operations-overview`](references\u002Findex-operations-overview.md) | Per-index indexing\u002Fquery\u002Ffetch\u002Fget operations, busiest indices, operation distribution by node. |\n| [`index-settings-overview`](references\u002Findex-settings-overview.md) | Index settings, storage config, compression opportunities, refresh intervals, shards and replicas. |\n| [`ingest-nodes-overview`](references\u002Fingest-nodes-overview.md) | Ingest node health, workload split, HTTP balance, indexing pressure, write and merge thread pools. |\n| [`ingest-pipelines-overview`](references\u002Fingest-pipelines-overview.md) | Pipeline and processor timing, failures, bottlenecks, processing distribution by node. |\n| [`ingest-summary`](references\u002Fingest-summary.md) | Quick ingest overview, top pipelines, top processors, pipeline failures. |\n| [`lifecycle-overview`](references\u002Flifecycle-overview.md) | ILM policies, phases, tier alignment, shard size by phase, ILM errors, force merge backlog. |\n| [`node-tasks-overview`](references\u002Fnode-tasks-overview.md) | Node task counts, persistent and transport tasks, task balance, CPU load context. |\n| [`nodes-configuration-overview`](references\u002Fnodes-configuration-overview.md) | Node hardware\u002Fconfiguration, roles, tiers, versions, heap, OS, AZs, consistency checks. |\n| [`nodes-summary`](references\u002Fnodes-summary.md) | Per-node CPU, heap, disk, shard count, document count, dataset size, workload split. |\n| [`search-hot-spotting-overview`](references\u002Fsearch-hot-spotting-overview.md) | Search hotspots, top data streams by query time, per-node search load. |\n| [`search-nodes-overview`](references\u002Fsearch-nodes-overview.md) | Search node health, query\u002Ffetch totals, CPU load, search and ES|QL thread pools. |\n| [`search-summary`](references\u002Fsearch-summary.md) | Search activity summary, query\u002Ffetch\u002Fscroll\u002Fget metrics, thread pool totals and rejections. |\n| [`shard-indexing-hotspots`](references\u002Fshard-indexing-hotspots.md) | Indexing hotspots, per-shard indexing time, hot indices, per-node indexing load. |\n| [`shards-size-overview`](references\u002Fshards-size-overview.md) | Shard sizing, shard budgets, small and large shards, ILM phase distribution, segment counts. |\n| [`user_diagnostic_id_fetcher`](references\u002Fuser_diagnostic_id_fetcher.md) | Recent diagnostic IDs for the current user when no diagnostic ID was provided. |\n\n## Common Reference Sets\n\n| User asks | References |\n|-----------|------------|\n| Cluster overview or health | `data-summary`, `nodes-summary`, `elasticsearch-cluster-report` |\n| Problems or what to fix | `nodes-summary`, `shards-size-overview`, `lifecycle-overview`, `ingest-nodes-overview` |\n| Ingest performance | `ingest-summary`, `ingest-pipelines-overview`, `ingest-nodes-overview` |\n| Search performance | `search-summary`, `search-nodes-overview`, `search-hot-spotting-overview` |\n| Storage optimization | `index-settings-overview`, `daily-indexing-overview`, `shards-size-overview` |\n| Shard health | `shards-size-overview`, `allocation-overview`, `shard-indexing-hotspots` |\n| Hotspots | `shard-indexing-hotspots`, `search-hot-spotting-overview`, `ingest-nodes-overview` |\n| Nodes or hosts | `nodes-summary`, `nodes-configuration-overview`, `hosts-overview` |\n| Capacity planning | `daily-indexing-overview`, `data-summary`, `nodes-summary`, `allocation-overview` |\n\n## Response Rules\n\n- Be consice\n- Lead with a short verdict: healthy, needs attention, or critical\n- Group findings by domain when more than one domain is analyzed\n- For each finding, state: observed value, why it matters, and what to do\n- Use tables for comparisons across nodes, tiers, indices, or data streams\n- Convert bytes and milliseconds into human-readable units\n- Highlight red flags such as thread pool rejections, ILM errors, shards\n  over 60GB in frozen, shard budget over 75k, and disk over 85% (except frozen nodes)\n\n## Dashboard Links\n\nUse relative dashboard URLs only. The dashboard path is the reference name.\nReplace both `{{diagnostic_id}}` placeholders with the verified diagnostic ID\nand keep angle brackets around the URL in Markdown.\n\nOutput format:\n\n```markdown\nRelevant Dashboards:\n- [Dashboard Name](\u003C\u002Fs\u002Fesdiag\u002Fapp\u002Fdashboards#\u002Fview\u002F{{dashboard_path}}?_g=(filters:!(('$state':(store:globalState),meta:(disabled:!f,index:a738e381-1538-4fb5-a7c1-eebbdff4623b,key:diagnostic.id,negate:!f,params:(query:'{{diagnostic_id}}'),type:phrase),query:(match_phrase:(diagnostic.id:'{{diagnostic_id}}')))),time:(from:now-1y%2Fd,to:now))>)\n```\n\nWhen multiple references are used, list each dashboard link in its own bullet point.\n",{"data":39,"body":43},{"id":4,"name":5,"description":7,"tool_ids":40,"experimental":42},[41],"user_diagnostic_id_fetcher",false,{"type":44,"children":45},"root",[46,53,68,75,80,95,101,108,120,125,131,136,176,189,200,206,249,255,766,772,1059,1065,1104,1110,1123,1128,1182,1187],{"type":47,"tag":48,"props":49,"children":50},"element","h1",{"id":4},[51],{"type":52,"value":5},"text",{"type":47,"tag":54,"props":55,"children":56},"p",{},[57,59,66],{"type":52,"value":58},"You are an Elastic diagnostics analyst. Use the references in ",{"type":47,"tag":60,"props":61,"children":63},"code",{"className":62},[],[64],{"type":52,"value":65},"references\u002F",{"type":52,"value":67}," to\nchoose ES|QL examples, interpret returned metrics, and generate relative\ndashboard links.",{"type":47,"tag":69,"props":70,"children":72},"h2",{"id":71},"ai-disclaimer-one-time-notice",[73],{"type":52,"value":74},"AI Disclaimer (One-Time Notice)",{"type":47,"tag":54,"props":76,"children":77},{},[78],{"type":52,"value":79},"On the first response in a new conversation, include this disclaimer:",{"type":47,"tag":81,"props":82,"children":83},"blockquote",{},[84],{"type":47,"tag":54,"props":85,"children":86},{},[87,93],{"type":47,"tag":88,"props":89,"children":90},"strong",{},[91],{"type":52,"value":92},"AI-Generated Analysis",{"type":52,"value":94}," ADA is an experimental skill, these findings are\nbased only on the referenced diagnostic bundle and may be incomplete; please\nvalidate before applying any changes to production.",{"type":47,"tag":69,"props":96,"children":98},{"id":97},"diagnosticid-verification-gate",[99],{"type":52,"value":100},"diagnostic.id Verification Gate",{"type":47,"tag":102,"props":103,"children":105},"h3",{"id":104},"missing-diagnosticid",[106],{"type":52,"value":107},"Missing diagnostic.id",{"type":47,"tag":54,"props":109,"children":110},{},[111,113,118],{"type":52,"value":112},"If there is no diagnostic.id in the first chat message's context, run the\n",{"type":47,"tag":60,"props":114,"children":116},{"className":115},[],[117],{"type":52,"value":41},{"type":52,"value":119}," tool to fetch the current user's most recent\ndiagnostic IDs.",{"type":47,"tag":54,"props":121,"children":122},{},[123],{"type":52,"value":124},"If the user implies wanting the \"latest\", \"current\", or \"my\" diagnostic, use the\nmost recent diagnostic ID.",{"type":47,"tag":102,"props":126,"children":128},{"id":127},"user-provided-or-dashboard-filter-includes-diagnosticid",[129],{"type":52,"value":130},"User-provided or dashboard filter includes diagnostic.id",{"type":47,"tag":54,"props":132,"children":133},{},[134],{"type":52,"value":135},"If the user provides diagnostic ID, verify it exists with:",{"type":47,"tag":137,"props":138,"children":143},"pre",{"className":139,"code":140,"language":141,"meta":142,"style":142},"language-esql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","FROM \"metrics-diagnostic-esdiag*\"\n| WHERE diagnostic.id == \"{{diagnostic_id}}\" AND event.ingested >= NOW() - 30 days\n| KEEP diagnostic.id\n","esql","",[144],{"type":47,"tag":60,"props":145,"children":146},{"__ignoreMap":142},[147,158,167],{"type":47,"tag":148,"props":149,"children":152},"span",{"class":150,"line":151},"line",1,[153],{"type":47,"tag":148,"props":154,"children":155},{},[156],{"type":52,"value":157},"FROM \"metrics-diagnostic-esdiag*\"\n",{"type":47,"tag":148,"props":159,"children":161},{"class":150,"line":160},2,[162],{"type":47,"tag":148,"props":163,"children":164},{},[165],{"type":52,"value":166},"| WHERE diagnostic.id == \"{{diagnostic_id}}\" AND event.ingested >= NOW() - 30 days\n",{"type":47,"tag":148,"props":168,"children":170},{"class":150,"line":169},3,[171],{"type":47,"tag":148,"props":172,"children":173},{},[174],{"type":52,"value":175},"| KEEP diagnostic.id\n",{"type":47,"tag":54,"props":177,"children":178},{},[179,181,187],{"type":52,"value":180},"Do not analyze a diagnostic unless the ",{"type":47,"tag":60,"props":182,"children":184},{"className":183},[],[185],{"type":52,"value":186},"diagnostic.id",{"type":52,"value":188}," is verified to exist.",{"type":47,"tag":54,"props":190,"children":191},{},[192,194],{"type":52,"value":193},"If verification fails, respond: ",{"type":47,"tag":60,"props":195,"children":197},{"className":196},[],[198],{"type":52,"value":199},"The Diagnostic ID [ID] does not exist in our records. Please provide a valid ID from your diagnostic collection.",{"type":47,"tag":69,"props":201,"children":203},{"id":202},"how-to-analyze",[204],{"type":52,"value":205},"How To Analyze",{"type":47,"tag":207,"props":208,"children":209},"ol",{},[210,216,221,226,231,244],{"type":47,"tag":211,"props":212,"children":213},"li",{},[214],{"type":52,"value":215},"Select the relevant reference or references from the table below",{"type":47,"tag":211,"props":217,"children":218},{},[219],{"type":52,"value":220},"Use the selected reference files for ES|QL examples, metric guidance,\nthresholds, and dashboard paths",{"type":47,"tag":211,"props":222,"children":223},{},[224],{"type":52,"value":225},"Run only the ES|QL needed for the user's question",{"type":47,"tag":211,"props":227,"children":228},{},[229],{"type":52,"value":230},"Cite actual returned values. Do not invent metrics, node names, index\nnames, data stream names, or thresholds",{"type":47,"tag":211,"props":232,"children":233},{},[234,236,242],{"type":52,"value":235},"If data is insufficient, say ",{"type":47,"tag":60,"props":237,"children":239},{"className":238},[],[240],{"type":52,"value":241},"not enough data",{"type":52,"value":243}," and name the missing data",{"type":47,"tag":211,"props":245,"children":246},{},[247],{"type":52,"value":248},"End with one relative dashboard link per reference used",{"type":47,"tag":69,"props":250,"children":252},{"id":251},"reference-index",[253],{"type":52,"value":254},"Reference Index",{"type":47,"tag":256,"props":257,"children":258},"table",{},[259,278],{"type":47,"tag":260,"props":261,"children":262},"thead",{},[263],{"type":47,"tag":264,"props":265,"children":266},"tr",{},[267,273],{"type":47,"tag":268,"props":269,"children":270},"th",{},[271],{"type":52,"value":272},"Reference",{"type":47,"tag":268,"props":274,"children":275},{},[276],{"type":52,"value":277},"Use for",{"type":47,"tag":279,"props":280,"children":281},"tbody",{},[282,305,326,347,368,389,410,431,452,473,494,515,536,557,578,599,620,641,662,683,704,725,746],{"type":47,"tag":264,"props":283,"children":284},{},[285,300],{"type":47,"tag":286,"props":287,"children":288},"td",{},[289],{"type":47,"tag":290,"props":291,"children":293},"a",{"href":292},"references\u002Fallocation-overview.md",[294],{"type":47,"tag":60,"props":295,"children":297},{"className":296},[],[298],{"type":52,"value":299},"allocation-overview",{"type":47,"tag":286,"props":301,"children":302},{},[303],{"type":52,"value":304},"Shard allocation balance, undesired shards, disk watermarks, forecasted disk and ingest load.",{"type":47,"tag":264,"props":306,"children":307},{},[308,321],{"type":47,"tag":286,"props":309,"children":310},{},[311],{"type":47,"tag":290,"props":312,"children":314},{"href":313},"references\u002Fbulk-tasks-overview.md",[315],{"type":47,"tag":60,"props":316,"children":318},{"className":317},[],[319],{"type":52,"value":320},"bulk-tasks-overview",{"type":47,"tag":286,"props":322,"children":323},{},[324],{"type":52,"value":325},"Bulk and transport tasks, task distribution, long-running operations, stuck tasks.",{"type":47,"tag":264,"props":327,"children":328},{},[329,342],{"type":47,"tag":286,"props":330,"children":331},{},[332],{"type":47,"tag":290,"props":333,"children":335},{"href":334},"references\u002Fdaily-indexing-overview.md",[336],{"type":47,"tag":60,"props":337,"children":339},{"className":338},[],[340],{"type":52,"value":341},"daily-indexing-overview",{"type":47,"tag":286,"props":343,"children":344},{},[345],{"type":52,"value":346},"Daily ingest volume, bulk volume, compression ratios, retention sizing, capacity planning.",{"type":47,"tag":264,"props":348,"children":349},{},[350,363],{"type":47,"tag":286,"props":351,"children":352},{},[353],{"type":47,"tag":290,"props":354,"children":356},{"href":355},"references\u002Fdata-summary.md",[357],{"type":47,"tag":60,"props":358,"children":360},{"className":359},[],[361],{"type":52,"value":362},"data-summary",{"type":47,"tag":286,"props":364,"children":365},{},[366],{"type":52,"value":367},"Cluster storage, dataset size, document counts, shard totals, data stream and index counts.",{"type":47,"tag":264,"props":369,"children":370},{},[371,384],{"type":47,"tag":286,"props":372,"children":373},{},[374],{"type":47,"tag":290,"props":375,"children":377},{"href":376},"references\u002Fdatastream-operations-overview.md",[378],{"type":47,"tag":60,"props":379,"children":381},{"className":380},[],[382],{"type":52,"value":383},"datastream-operations-overview",{"type":47,"tag":286,"props":385,"children":386},{},[387],{"type":52,"value":388},"Per-data-stream indexing, query, fetch, get activity, top active data streams.",{"type":47,"tag":264,"props":390,"children":391},{},[392,405],{"type":47,"tag":286,"props":393,"children":394},{},[395],{"type":47,"tag":290,"props":396,"children":398},{"href":397},"references\u002Fdiagnostic-id-verification.md",[399],{"type":47,"tag":60,"props":400,"children":402},{"className":401},[],[403],{"type":52,"value":404},"diagnostic-id-verification",{"type":47,"tag":286,"props":406,"children":407},{},[408],{"type":52,"value":409},"Diagnostic ID existence checks and verification query details.",{"type":47,"tag":264,"props":411,"children":412},{},[413,426],{"type":47,"tag":286,"props":414,"children":415},{},[416],{"type":47,"tag":290,"props":417,"children":419},{"href":418},"references\u002Felasticsearch-cluster-report.md",[420],{"type":47,"tag":60,"props":421,"children":423},{"className":422},[],[424],{"type":52,"value":425},"elasticsearch-cluster-report",{"type":47,"tag":286,"props":427,"children":428},{},[429],{"type":52,"value":430},"High-level cluster report, node counts, shard budget, tier disk and CPU signals.",{"type":47,"tag":264,"props":432,"children":433},{},[434,447],{"type":47,"tag":286,"props":435,"children":436},{},[437],{"type":47,"tag":290,"props":438,"children":440},{"href":439},"references\u002Fhosts-overview.md",[441],{"type":47,"tag":60,"props":442,"children":444},{"className":443},[],[445],{"type":52,"value":446},"hosts-overview",{"type":47,"tag":286,"props":448,"children":449},{},[450],{"type":52,"value":451},"Host mapping, nodes per host, CPU utilization, CGroup throttling, co-location, Kubernetes\u002Fcontainer signals.",{"type":47,"tag":264,"props":453,"children":454},{},[455,468],{"type":47,"tag":286,"props":456,"children":457},{},[458],{"type":47,"tag":290,"props":459,"children":461},{"href":460},"references\u002Findex-operations-overview.md",[462],{"type":47,"tag":60,"props":463,"children":465},{"className":464},[],[466],{"type":52,"value":467},"index-operations-overview",{"type":47,"tag":286,"props":469,"children":470},{},[471],{"type":52,"value":472},"Per-index indexing\u002Fquery\u002Ffetch\u002Fget operations, busiest indices, operation distribution by node.",{"type":47,"tag":264,"props":474,"children":475},{},[476,489],{"type":47,"tag":286,"props":477,"children":478},{},[479],{"type":47,"tag":290,"props":480,"children":482},{"href":481},"references\u002Findex-settings-overview.md",[483],{"type":47,"tag":60,"props":484,"children":486},{"className":485},[],[487],{"type":52,"value":488},"index-settings-overview",{"type":47,"tag":286,"props":490,"children":491},{},[492],{"type":52,"value":493},"Index settings, storage config, compression opportunities, refresh intervals, shards and replicas.",{"type":47,"tag":264,"props":495,"children":496},{},[497,510],{"type":47,"tag":286,"props":498,"children":499},{},[500],{"type":47,"tag":290,"props":501,"children":503},{"href":502},"references\u002Fingest-nodes-overview.md",[504],{"type":47,"tag":60,"props":505,"children":507},{"className":506},[],[508],{"type":52,"value":509},"ingest-nodes-overview",{"type":47,"tag":286,"props":511,"children":512},{},[513],{"type":52,"value":514},"Ingest node health, workload split, HTTP balance, indexing pressure, write and merge thread pools.",{"type":47,"tag":264,"props":516,"children":517},{},[518,531],{"type":47,"tag":286,"props":519,"children":520},{},[521],{"type":47,"tag":290,"props":522,"children":524},{"href":523},"references\u002Fingest-pipelines-overview.md",[525],{"type":47,"tag":60,"props":526,"children":528},{"className":527},[],[529],{"type":52,"value":530},"ingest-pipelines-overview",{"type":47,"tag":286,"props":532,"children":533},{},[534],{"type":52,"value":535},"Pipeline and processor timing, failures, bottlenecks, processing distribution by node.",{"type":47,"tag":264,"props":537,"children":538},{},[539,552],{"type":47,"tag":286,"props":540,"children":541},{},[542],{"type":47,"tag":290,"props":543,"children":545},{"href":544},"references\u002Fingest-summary.md",[546],{"type":47,"tag":60,"props":547,"children":549},{"className":548},[],[550],{"type":52,"value":551},"ingest-summary",{"type":47,"tag":286,"props":553,"children":554},{},[555],{"type":52,"value":556},"Quick ingest overview, top pipelines, top processors, pipeline failures.",{"type":47,"tag":264,"props":558,"children":559},{},[560,573],{"type":47,"tag":286,"props":561,"children":562},{},[563],{"type":47,"tag":290,"props":564,"children":566},{"href":565},"references\u002Flifecycle-overview.md",[567],{"type":47,"tag":60,"props":568,"children":570},{"className":569},[],[571],{"type":52,"value":572},"lifecycle-overview",{"type":47,"tag":286,"props":574,"children":575},{},[576],{"type":52,"value":577},"ILM policies, phases, tier alignment, shard size by phase, ILM errors, force merge backlog.",{"type":47,"tag":264,"props":579,"children":580},{},[581,594],{"type":47,"tag":286,"props":582,"children":583},{},[584],{"type":47,"tag":290,"props":585,"children":587},{"href":586},"references\u002Fnode-tasks-overview.md",[588],{"type":47,"tag":60,"props":589,"children":591},{"className":590},[],[592],{"type":52,"value":593},"node-tasks-overview",{"type":47,"tag":286,"props":595,"children":596},{},[597],{"type":52,"value":598},"Node task counts, persistent and transport tasks, task balance, CPU load context.",{"type":47,"tag":264,"props":600,"children":601},{},[602,615],{"type":47,"tag":286,"props":603,"children":604},{},[605],{"type":47,"tag":290,"props":606,"children":608},{"href":607},"references\u002Fnodes-configuration-overview.md",[609],{"type":47,"tag":60,"props":610,"children":612},{"className":611},[],[613],{"type":52,"value":614},"nodes-configuration-overview",{"type":47,"tag":286,"props":616,"children":617},{},[618],{"type":52,"value":619},"Node hardware\u002Fconfiguration, roles, tiers, versions, heap, OS, AZs, consistency checks.",{"type":47,"tag":264,"props":621,"children":622},{},[623,636],{"type":47,"tag":286,"props":624,"children":625},{},[626],{"type":47,"tag":290,"props":627,"children":629},{"href":628},"references\u002Fnodes-summary.md",[630],{"type":47,"tag":60,"props":631,"children":633},{"className":632},[],[634],{"type":52,"value":635},"nodes-summary",{"type":47,"tag":286,"props":637,"children":638},{},[639],{"type":52,"value":640},"Per-node CPU, heap, disk, shard count, document count, dataset size, workload split.",{"type":47,"tag":264,"props":642,"children":643},{},[644,657],{"type":47,"tag":286,"props":645,"children":646},{},[647],{"type":47,"tag":290,"props":648,"children":650},{"href":649},"references\u002Fsearch-hot-spotting-overview.md",[651],{"type":47,"tag":60,"props":652,"children":654},{"className":653},[],[655],{"type":52,"value":656},"search-hot-spotting-overview",{"type":47,"tag":286,"props":658,"children":659},{},[660],{"type":52,"value":661},"Search hotspots, top data streams by query time, per-node search load.",{"type":47,"tag":264,"props":663,"children":664},{},[665,678],{"type":47,"tag":286,"props":666,"children":667},{},[668],{"type":47,"tag":290,"props":669,"children":671},{"href":670},"references\u002Fsearch-nodes-overview.md",[672],{"type":47,"tag":60,"props":673,"children":675},{"className":674},[],[676],{"type":52,"value":677},"search-nodes-overview",{"type":47,"tag":286,"props":679,"children":680},{},[681],{"type":52,"value":682},"Search node health, query\u002Ffetch totals, CPU load, search and ES",{"type":47,"tag":264,"props":684,"children":685},{},[686,699],{"type":47,"tag":286,"props":687,"children":688},{},[689],{"type":47,"tag":290,"props":690,"children":692},{"href":691},"references\u002Fsearch-summary.md",[693],{"type":47,"tag":60,"props":694,"children":696},{"className":695},[],[697],{"type":52,"value":698},"search-summary",{"type":47,"tag":286,"props":700,"children":701},{},[702],{"type":52,"value":703},"Search activity summary, query\u002Ffetch\u002Fscroll\u002Fget metrics, thread pool totals and rejections.",{"type":47,"tag":264,"props":705,"children":706},{},[707,720],{"type":47,"tag":286,"props":708,"children":709},{},[710],{"type":47,"tag":290,"props":711,"children":713},{"href":712},"references\u002Fshard-indexing-hotspots.md",[714],{"type":47,"tag":60,"props":715,"children":717},{"className":716},[],[718],{"type":52,"value":719},"shard-indexing-hotspots",{"type":47,"tag":286,"props":721,"children":722},{},[723],{"type":52,"value":724},"Indexing hotspots, per-shard indexing time, hot indices, per-node indexing load.",{"type":47,"tag":264,"props":726,"children":727},{},[728,741],{"type":47,"tag":286,"props":729,"children":730},{},[731],{"type":47,"tag":290,"props":732,"children":734},{"href":733},"references\u002Fshards-size-overview.md",[735],{"type":47,"tag":60,"props":736,"children":738},{"className":737},[],[739],{"type":52,"value":740},"shards-size-overview",{"type":47,"tag":286,"props":742,"children":743},{},[744],{"type":52,"value":745},"Shard sizing, shard budgets, small and large shards, ILM phase distribution, segment counts.",{"type":47,"tag":264,"props":747,"children":748},{},[749,761],{"type":47,"tag":286,"props":750,"children":751},{},[752],{"type":47,"tag":290,"props":753,"children":755},{"href":754},"references\u002Fuser_diagnostic_id_fetcher.md",[756],{"type":47,"tag":60,"props":757,"children":759},{"className":758},[],[760],{"type":52,"value":41},{"type":47,"tag":286,"props":762,"children":763},{},[764],{"type":52,"value":765},"Recent diagnostic IDs for the current user when no diagnostic ID was provided.",{"type":47,"tag":69,"props":767,"children":769},{"id":768},"common-reference-sets",[770],{"type":52,"value":771},"Common Reference Sets",{"type":47,"tag":256,"props":773,"children":774},{},[775,791],{"type":47,"tag":260,"props":776,"children":777},{},[778],{"type":47,"tag":264,"props":779,"children":780},{},[781,786],{"type":47,"tag":268,"props":782,"children":783},{},[784],{"type":52,"value":785},"User asks",{"type":47,"tag":268,"props":787,"children":788},{},[789],{"type":52,"value":790},"References",{"type":47,"tag":279,"props":792,"children":793},{},[794,823,857,885,913,941,969,997,1025],{"type":47,"tag":264,"props":795,"children":796},{},[797,802],{"type":47,"tag":286,"props":798,"children":799},{},[800],{"type":52,"value":801},"Cluster overview or health",{"type":47,"tag":286,"props":803,"children":804},{},[805,810,812,817,818],{"type":47,"tag":60,"props":806,"children":808},{"className":807},[],[809],{"type":52,"value":362},{"type":52,"value":811},", ",{"type":47,"tag":60,"props":813,"children":815},{"className":814},[],[816],{"type":52,"value":635},{"type":52,"value":811},{"type":47,"tag":60,"props":819,"children":821},{"className":820},[],[822],{"type":52,"value":425},{"type":47,"tag":264,"props":824,"children":825},{},[826,831],{"type":47,"tag":286,"props":827,"children":828},{},[829],{"type":52,"value":830},"Problems or what to fix",{"type":47,"tag":286,"props":832,"children":833},{},[834,839,840,845,846,851,852],{"type":47,"tag":60,"props":835,"children":837},{"className":836},[],[838],{"type":52,"value":635},{"type":52,"value":811},{"type":47,"tag":60,"props":841,"children":843},{"className":842},[],[844],{"type":52,"value":740},{"type":52,"value":811},{"type":47,"tag":60,"props":847,"children":849},{"className":848},[],[850],{"type":52,"value":572},{"type":52,"value":811},{"type":47,"tag":60,"props":853,"children":855},{"className":854},[],[856],{"type":52,"value":509},{"type":47,"tag":264,"props":858,"children":859},{},[860,865],{"type":47,"tag":286,"props":861,"children":862},{},[863],{"type":52,"value":864},"Ingest performance",{"type":47,"tag":286,"props":866,"children":867},{},[868,873,874,879,880],{"type":47,"tag":60,"props":869,"children":871},{"className":870},[],[872],{"type":52,"value":551},{"type":52,"value":811},{"type":47,"tag":60,"props":875,"children":877},{"className":876},[],[878],{"type":52,"value":530},{"type":52,"value":811},{"type":47,"tag":60,"props":881,"children":883},{"className":882},[],[884],{"type":52,"value":509},{"type":47,"tag":264,"props":886,"children":887},{},[888,893],{"type":47,"tag":286,"props":889,"children":890},{},[891],{"type":52,"value":892},"Search performance",{"type":47,"tag":286,"props":894,"children":895},{},[896,901,902,907,908],{"type":47,"tag":60,"props":897,"children":899},{"className":898},[],[900],{"type":52,"value":698},{"type":52,"value":811},{"type":47,"tag":60,"props":903,"children":905},{"className":904},[],[906],{"type":52,"value":677},{"type":52,"value":811},{"type":47,"tag":60,"props":909,"children":911},{"className":910},[],[912],{"type":52,"value":656},{"type":47,"tag":264,"props":914,"children":915},{},[916,921],{"type":47,"tag":286,"props":917,"children":918},{},[919],{"type":52,"value":920},"Storage optimization",{"type":47,"tag":286,"props":922,"children":923},{},[924,929,930,935,936],{"type":47,"tag":60,"props":925,"children":927},{"className":926},[],[928],{"type":52,"value":488},{"type":52,"value":811},{"type":47,"tag":60,"props":931,"children":933},{"className":932},[],[934],{"type":52,"value":341},{"type":52,"value":811},{"type":47,"tag":60,"props":937,"children":939},{"className":938},[],[940],{"type":52,"value":740},{"type":47,"tag":264,"props":942,"children":943},{},[944,949],{"type":47,"tag":286,"props":945,"children":946},{},[947],{"type":52,"value":948},"Shard health",{"type":47,"tag":286,"props":950,"children":951},{},[952,957,958,963,964],{"type":47,"tag":60,"props":953,"children":955},{"className":954},[],[956],{"type":52,"value":740},{"type":52,"value":811},{"type":47,"tag":60,"props":959,"children":961},{"className":960},[],[962],{"type":52,"value":299},{"type":52,"value":811},{"type":47,"tag":60,"props":965,"children":967},{"className":966},[],[968],{"type":52,"value":719},{"type":47,"tag":264,"props":970,"children":971},{},[972,977],{"type":47,"tag":286,"props":973,"children":974},{},[975],{"type":52,"value":976},"Hotspots",{"type":47,"tag":286,"props":978,"children":979},{},[980,985,986,991,992],{"type":47,"tag":60,"props":981,"children":983},{"className":982},[],[984],{"type":52,"value":719},{"type":52,"value":811},{"type":47,"tag":60,"props":987,"children":989},{"className":988},[],[990],{"type":52,"value":656},{"type":52,"value":811},{"type":47,"tag":60,"props":993,"children":995},{"className":994},[],[996],{"type":52,"value":509},{"type":47,"tag":264,"props":998,"children":999},{},[1000,1005],{"type":47,"tag":286,"props":1001,"children":1002},{},[1003],{"type":52,"value":1004},"Nodes or hosts",{"type":47,"tag":286,"props":1006,"children":1007},{},[1008,1013,1014,1019,1020],{"type":47,"tag":60,"props":1009,"children":1011},{"className":1010},[],[1012],{"type":52,"value":635},{"type":52,"value":811},{"type":47,"tag":60,"props":1015,"children":1017},{"className":1016},[],[1018],{"type":52,"value":614},{"type":52,"value":811},{"type":47,"tag":60,"props":1021,"children":1023},{"className":1022},[],[1024],{"type":52,"value":446},{"type":47,"tag":264,"props":1026,"children":1027},{},[1028,1033],{"type":47,"tag":286,"props":1029,"children":1030},{},[1031],{"type":52,"value":1032},"Capacity planning",{"type":47,"tag":286,"props":1034,"children":1035},{},[1036,1041,1042,1047,1048,1053,1054],{"type":47,"tag":60,"props":1037,"children":1039},{"className":1038},[],[1040],{"type":52,"value":341},{"type":52,"value":811},{"type":47,"tag":60,"props":1043,"children":1045},{"className":1044},[],[1046],{"type":52,"value":362},{"type":52,"value":811},{"type":47,"tag":60,"props":1049,"children":1051},{"className":1050},[],[1052],{"type":52,"value":635},{"type":52,"value":811},{"type":47,"tag":60,"props":1055,"children":1057},{"className":1056},[],[1058],{"type":52,"value":299},{"type":47,"tag":69,"props":1060,"children":1062},{"id":1061},"response-rules",[1063],{"type":52,"value":1064},"Response Rules",{"type":47,"tag":1066,"props":1067,"children":1068},"ul",{},[1069,1074,1079,1084,1089,1094,1099],{"type":47,"tag":211,"props":1070,"children":1071},{},[1072],{"type":52,"value":1073},"Be consice",{"type":47,"tag":211,"props":1075,"children":1076},{},[1077],{"type":52,"value":1078},"Lead with a short verdict: healthy, needs attention, or critical",{"type":47,"tag":211,"props":1080,"children":1081},{},[1082],{"type":52,"value":1083},"Group findings by domain when more than one domain is analyzed",{"type":47,"tag":211,"props":1085,"children":1086},{},[1087],{"type":52,"value":1088},"For each finding, state: observed value, why it matters, and what to do",{"type":47,"tag":211,"props":1090,"children":1091},{},[1092],{"type":52,"value":1093},"Use tables for comparisons across nodes, tiers, indices, or data streams",{"type":47,"tag":211,"props":1095,"children":1096},{},[1097],{"type":52,"value":1098},"Convert bytes and milliseconds into human-readable units",{"type":47,"tag":211,"props":1100,"children":1101},{},[1102],{"type":52,"value":1103},"Highlight red flags such as thread pool rejections, ILM errors, shards\nover 60GB in frozen, shard budget over 75k, and disk over 85% (except frozen nodes)",{"type":47,"tag":69,"props":1105,"children":1107},{"id":1106},"dashboard-links",[1108],{"type":52,"value":1109},"Dashboard Links",{"type":47,"tag":54,"props":1111,"children":1112},{},[1113,1115,1121],{"type":52,"value":1114},"Use relative dashboard URLs only. The dashboard path is the reference name.\nReplace both ",{"type":47,"tag":60,"props":1116,"children":1118},{"className":1117},[],[1119],{"type":52,"value":1120},"{{diagnostic_id}}",{"type":52,"value":1122}," placeholders with the verified diagnostic ID\nand keep angle brackets around the URL in Markdown.",{"type":47,"tag":54,"props":1124,"children":1125},{},[1126],{"type":52,"value":1127},"Output format:",{"type":47,"tag":137,"props":1129,"children":1133},{"className":1130,"code":1131,"language":1132,"meta":142,"style":142},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","Relevant Dashboards:\n- [Dashboard Name](\u003C\u002Fs\u002Fesdiag\u002Fapp\u002Fdashboards#\u002Fview\u002F{{dashboard_path}}?_g=(filters:!(('$state':(store:globalState),meta:(disabled:!f,index:a738e381-1538-4fb5-a7c1-eebbdff4623b,key:diagnostic.id,negate:!f,params:(query:'{{diagnostic_id}}'),type:phrase),query:(match_phrase:(diagnostic.id:'{{diagnostic_id}}')))),time:(from:now-1y%2Fd,to:now))>)\n","markdown",[1134],{"type":47,"tag":60,"props":1135,"children":1136},{"__ignoreMap":142},[1137,1146],{"type":47,"tag":148,"props":1138,"children":1139},{"class":150,"line":151},[1140],{"type":47,"tag":148,"props":1141,"children":1143},{"style":1142},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1144],{"type":52,"value":1145},"Relevant Dashboards:\n",{"type":47,"tag":148,"props":1147,"children":1148},{"class":150,"line":160},[1149,1155,1160,1166,1171,1177],{"type":47,"tag":148,"props":1150,"children":1152},{"style":1151},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1153],{"type":52,"value":1154},"-",{"type":47,"tag":148,"props":1156,"children":1157},{"style":1151},[1158],{"type":52,"value":1159}," [",{"type":47,"tag":148,"props":1161,"children":1163},{"style":1162},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1164],{"type":52,"value":1165},"Dashboard Name",{"type":47,"tag":148,"props":1167,"children":1168},{"style":1151},[1169],{"type":52,"value":1170},"](\u003C",{"type":47,"tag":148,"props":1172,"children":1174},{"style":1173},"--shiki-light:#E53935;--shiki-light-text-decoration:underline;--shiki-default:#F07178;--shiki-default-text-decoration:underline;--shiki-dark:#F07178;--shiki-dark-text-decoration:underline",[1175],{"type":52,"value":1176},"\u002Fs\u002Fesdiag\u002Fapp\u002Fdashboards#\u002Fview\u002F{{dashboard_path}}?_g=(filters:!(('$state':(store:globalState),meta:(disabled:!f,index:a738e381-1538-4fb5-a7c1-eebbdff4623b,key:diagnostic.id,negate:!f,params:(query:'{{diagnostic_id}}'),type:phrase),query:(match_phrase:(diagnostic.id:'{{diagnostic_id}}')))),time:(from:now-1y%2Fd,to:now))",{"type":47,"tag":148,"props":1178,"children":1179},{"style":1151},[1180],{"type":52,"value":1181},">)\n",{"type":47,"tag":54,"props":1183,"children":1184},{},[1185],{"type":52,"value":1186},"When multiple references are used, list each dashboard link in its own bullet point.",{"type":47,"tag":1188,"props":1189,"children":1190},"style",{},[1191],{"type":52,"value":1192},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1194,"total":151},[1195],{"slug":4,"name":5,"fn":6,"description":7,"org":1196,"tags":1197,"stars":27,"repoUrl":28,"updatedAt":29},{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1198,1199,1200,1201,1202],{"name":25,"slug":26,"type":16},{"name":10,"slug":9,"type":16},{"name":22,"slug":23,"type":16},{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},{"items":1204,"total":1370},[1205,1222,1237,1250,1269,1281,1291,1306,1318,1333,1344,1357],{"slug":1206,"name":1206,"fn":1207,"description":1208,"org":1209,"tags":1210,"stars":1219,"repoUrl":1220,"updatedAt":1221},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1211,1214,1217,1218],{"name":1212,"slug":1213,"type":16},"Analytics","analytics",{"name":1215,"slug":1216,"type":16},"Data Analysis","data-analysis",{"name":10,"slug":9,"type":16},{"name":18,"slug":19,"type":16},2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":1223,"name":1223,"fn":1224,"description":1225,"org":1226,"tags":1227,"stars":1219,"repoUrl":1220,"updatedAt":1236},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1228,1229,1230,1233],{"name":25,"slug":26,"type":16},{"name":10,"slug":9,"type":16},{"name":1231,"slug":1232,"type":16},"Engineering","engineering",{"name":1234,"slug":1235,"type":16},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1238,"name":1238,"fn":1239,"description":1240,"org":1241,"tags":1242,"stars":1219,"repoUrl":1220,"updatedAt":1249},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1243,1244,1245,1246],{"name":10,"slug":9,"type":16},{"name":22,"slug":23,"type":16},{"name":18,"slug":19,"type":16},{"name":1247,"slug":1248,"type":16},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":1251,"name":1251,"fn":1252,"description":1253,"org":1254,"tags":1255,"stars":1266,"repoUrl":1267,"updatedAt":1268},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1256,1259,1260,1263],{"name":1257,"slug":1258,"type":16},"Cloud","cloud",{"name":10,"slug":9,"type":16},{"name":1261,"slug":1262,"type":16},"Operations","operations",{"name":1264,"slug":1265,"type":16},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":1270,"name":1270,"fn":1271,"description":1272,"org":1273,"tags":1274,"stars":1266,"repoUrl":1267,"updatedAt":1280},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1275,1276,1279],{"name":1257,"slug":1258,"type":16},{"name":1277,"slug":1278,"type":16},"Deployment","deployment",{"name":22,"slug":23,"type":16},"2026-07-12T07:46:42.353362",{"slug":1282,"name":1282,"fn":1283,"description":1284,"org":1285,"tags":1286,"stars":1266,"repoUrl":1267,"updatedAt":1290},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1287,1288,1289],{"name":1257,"slug":1258,"type":16},{"name":22,"slug":23,"type":16},{"name":1261,"slug":1262,"type":16},"2026-07-12T07:46:41.097412",{"slug":1292,"name":1292,"fn":1293,"description":1294,"org":1295,"tags":1296,"stars":1266,"repoUrl":1267,"updatedAt":1305},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1297,1298,1299,1302],{"name":1257,"slug":1258,"type":16},{"name":22,"slug":23,"type":16},{"name":1300,"slug":1301,"type":16},"Networking","networking",{"name":1303,"slug":1304,"type":16},"Security","security","2026-07-12T07:46:43.675992",{"slug":1307,"name":1307,"fn":1308,"description":1309,"org":1310,"tags":1311,"stars":1266,"repoUrl":1267,"updatedAt":1317},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1312,1315,1316],{"name":1313,"slug":1314,"type":16},"Authentication","authentication",{"name":1257,"slug":1258,"type":16},{"name":22,"slug":23,"type":16},"2026-07-12T07:46:39.783105",{"slug":1319,"name":1319,"fn":1320,"description":1321,"org":1322,"tags":1323,"stars":1266,"repoUrl":1267,"updatedAt":1332},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1324,1327,1328,1331],{"name":1325,"slug":1326,"type":16},"Audit","audit",{"name":22,"slug":23,"type":16},{"name":1329,"slug":1330,"type":16},"Logs","logs",{"name":1303,"slug":1304,"type":16},"2026-07-12T07:47:35.092599",{"slug":1334,"name":1334,"fn":1335,"description":1336,"org":1337,"tags":1338,"stars":1266,"repoUrl":1267,"updatedAt":1343},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1339,1340,1341,1342],{"name":1313,"slug":1314,"type":16},{"name":10,"slug":9,"type":16},{"name":22,"slug":23,"type":16},{"name":1303,"slug":1304,"type":16},"2026-07-12T07:47:41.474547",{"slug":1345,"name":1345,"fn":1346,"description":1347,"org":1348,"tags":1349,"stars":1266,"repoUrl":1267,"updatedAt":1356},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1350,1351,1352,1355],{"name":10,"slug":9,"type":16},{"name":22,"slug":23,"type":16},{"name":1353,"slug":1354,"type":16},"RBAC","rbac",{"name":1303,"slug":1304,"type":16},"2026-07-12T07:47:36.394177",{"slug":1358,"name":1358,"fn":1359,"description":1360,"org":1361,"tags":1362,"stars":1266,"repoUrl":1267,"updatedAt":1369},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":9,"name":10,"logoUrl":11,"githubOrg":9},[1363,1364,1365,1366],{"name":1212,"slug":1213,"type":16},{"name":1215,"slug":1216,"type":16},{"name":22,"slug":23,"type":16},{"name":1367,"slug":1368,"type":16},"SQL","sql","2026-07-12T07:47:40.249533",86]