[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-elastic-cli-usage":3,"mdc--ys3mhz-key":36,"related-org-elastic-elastic-cli-usage":680,"related-repo-elastic-elastic-cli-usage":850},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":34,"mdContent":35},"elastic-cli-usage","execute Elasticsearch CLI commands","Guides execution of elasticsearch CLI commands via elastic_cli, resolves serverless-specific errors, and routes tasks between CLI and MCP\u002FKibana API tools. Use when running es or kb commands, debugging elastic CLI argument syntax, hitting 410 serverless errors, or deciding whether to use elastic_cli vs native Kibana tools.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17,20,23],{"name":13,"slug":14,"type":15},"CLI","cli","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Kibana","kibana",{"name":21,"slug":22,"type":15},"Elasticsearch","elasticsearch",{"name":24,"slug":25,"type":15},"Debugging","debugging",16,"https:\u002F\u002Fgithub.com\u002Felastic\u002Felastic-ramen","2026-07-12T07:49:44.954024",null,4,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":29},[],"https:\u002F\u002Fgithub.com\u002Felastic\u002Felastic-ramen\u002Ftree\u002FHEAD\u002Fpackages\u002Fopencode\u002Fsrc\u002Felastic\u002Fskills\u002Felastic-cli-usage","---\nname: elastic-cli-usage\ndescription: \"Guides execution of elasticsearch CLI commands via elastic_cli, resolves serverless-specific errors, and routes tasks between CLI and MCP\u002FKibana API tools. Use when running es or kb commands, debugging elastic CLI argument syntax, hitting 410 serverless errors, or deciding whether to use elastic_cli vs native Kibana tools.\"\nmetadata:\n  version: 0.3.0\n  visibility: public\n---\n\n# Skill: elastic-cli-usage (verified gotchas)\n\nUse `elastic_cli` tool for all CLI operations — credentials are injected automatically.\nPass `argv` as a JSON array of strings, e.g. `[\"es\",\"cluster\",\"health\",\"--json\"]`.\nThe `elastic` binary is NOT on PATH in the shell environment; never use bash for this.\n\nFor anything not listed here, call `elastic_cli` with `[\"es\",\"\u003Cnamespace>\",\"--help\"]` or `[\"kb\",\"\u003Cnamespace>\",\"--help\"]`.\n\n---\n\n## Shorthands\n\n`es` = `stack es`, `kb` = `stack kb`. Both work.\n\n---\n\n## Prefer MCP\u002Fnative tools over CLI\n\n| Task | Prefer instead |\n|------|---------------|\n| ES\\|QL queries | `eab_platform_core_execute_esql` |\n| Index\u002Fdatastream listing | `eab_platform_core_list_indices` |\n| Streams | `eab_platform_streams_*` |\n| Agent builder | `kibana_list_agents`, `kibana_list_tools` |\n\n---\n\n## Gotchas\n\n### Serverless: many cluster APIs return 410\n\nThese all fail on serverless with \"not available in serverless mode\":\n\n- `es cluster health` \u002F `stats` \u002F `get-settings`\n- `es ilm get-lifecycle` \u002F `get-status`\n\nUse `es cat count --json` to verify connectivity on serverless instead.\n\n### `es indices list` does not exist\n\nUse `es indices get --index \"*\" --json` or `es indices get-data-stream --json`.\n\n### `es cluster health-report` does not exist\n\nThe subcommand is `es cluster health`. There is no `health-report`.\n\n### Agent builder subcommands use verbose REST-style names\n\n`kb agent-builder agents list` and `tools list` do **not** exist. Real commands:\n\n```\nkb agent-builder get-agent-builder-agents --json\nkb agent-builder get-agent-builder-tools --json\n```\n\nPattern: `\u003Chttp-method>-\u003Cresource-path>` throughout all of `kb`.\n\n### `docs search` and `docs read` require named flags, not positional args\n\n```\n# WRONG — \"too many arguments\" error\n[\"docs\",\"search\",\"index lifecycle management\"]\n[\"docs\",\"read\",\"https:\u002F\u002Fwww.elastic.co\u002F...\"]\n\n# CORRECT\n[\"docs\",\"search\",\"--query\",\"index lifecycle management\"]\n[\"docs\",\"read\",\"--path\",\"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002F...\"]\n```\n\nAlso: old `\u002Fguide\u002F` URLs return `(no output)`. Use `elastic.co\u002Fdocs\u002F` URLs.\n\n### `es esql query` requires `--query` flag, not positional\n\n```\n# WRONG\n[\"es\",\"esql\",\"query\",\"FROM logs-* | LIMIT 1\"]\n\n# CORRECT\n[\"es\",\"esql\",\"query\",\"--query\",\"FROM logs-* | LIMIT 1\",\"--json\"]\n```\n\n### `kb slo find-slos-op` requires `--space-id`\n\nOmitting it returns a validation error. Use `--space-id default`.\n\n### `--output-fields` and `--output-template` are per-subcommand flags (placed at end)\n\nThey are listed as global flags in the help but must come after the full subcommand.\n`--output-fields` returns `{}` for array responses — unreliable, avoid it.\n`--output-template` only works for top-level scalar fields.\nJust use `--json` and process the output.\n\n### Never block on stdin\n\nNever use `--input-file \u002Fdev\u002Fstdin` or `es helpers watch`. These block forever\nand hang the `elastic_cli` tool with no way to cancel.\n",{"data":37,"body":41},{"name":4,"description":6,"metadata":38},{"version":39,"visibility":40},"0.3.0","public",{"type":42,"children":43},"root",[44,53,91,119,123,130,164,167,173,276,279,285,292,297,342,354,366,384,395,414,420,447,459,478,497,506,535,555,564,581,593,612,647,653],{"type":45,"tag":46,"props":47,"children":49},"element","h1",{"id":48},"skill-elastic-cli-usage-verified-gotchas",[50],{"type":51,"value":52},"text","Skill: elastic-cli-usage (verified gotchas)",{"type":45,"tag":54,"props":55,"children":56},"p",{},[57,59,66,68,74,76,82,84,89],{"type":51,"value":58},"Use ",{"type":45,"tag":60,"props":61,"children":63},"code",{"className":62},[],[64],{"type":51,"value":65},"elastic_cli",{"type":51,"value":67}," tool for all CLI operations — credentials are injected automatically.\nPass ",{"type":45,"tag":60,"props":69,"children":71},{"className":70},[],[72],{"type":51,"value":73},"argv",{"type":51,"value":75}," as a JSON array of strings, e.g. ",{"type":45,"tag":60,"props":77,"children":79},{"className":78},[],[80],{"type":51,"value":81},"[\"es\",\"cluster\",\"health\",\"--json\"]",{"type":51,"value":83},".\nThe ",{"type":45,"tag":60,"props":85,"children":87},{"className":86},[],[88],{"type":51,"value":8},{"type":51,"value":90}," binary is NOT on PATH in the shell environment; never use bash for this.",{"type":45,"tag":54,"props":92,"children":93},{},[94,96,101,103,109,111,117],{"type":51,"value":95},"For anything not listed here, call ",{"type":45,"tag":60,"props":97,"children":99},{"className":98},[],[100],{"type":51,"value":65},{"type":51,"value":102}," with ",{"type":45,"tag":60,"props":104,"children":106},{"className":105},[],[107],{"type":51,"value":108},"[\"es\",\"\u003Cnamespace>\",\"--help\"]",{"type":51,"value":110}," or ",{"type":45,"tag":60,"props":112,"children":114},{"className":113},[],[115],{"type":51,"value":116},"[\"kb\",\"\u003Cnamespace>\",\"--help\"]",{"type":51,"value":118},".",{"type":45,"tag":120,"props":121,"children":122},"hr",{},[],{"type":45,"tag":124,"props":125,"children":127},"h2",{"id":126},"shorthands",[128],{"type":51,"value":129},"Shorthands",{"type":45,"tag":54,"props":131,"children":132},{},[133,139,141,147,149,155,156,162],{"type":45,"tag":60,"props":134,"children":136},{"className":135},[],[137],{"type":51,"value":138},"es",{"type":51,"value":140}," = ",{"type":45,"tag":60,"props":142,"children":144},{"className":143},[],[145],{"type":51,"value":146},"stack es",{"type":51,"value":148},", ",{"type":45,"tag":60,"props":150,"children":152},{"className":151},[],[153],{"type":51,"value":154},"kb",{"type":51,"value":140},{"type":45,"tag":60,"props":157,"children":159},{"className":158},[],[160],{"type":51,"value":161},"stack kb",{"type":51,"value":163},". Both work.",{"type":45,"tag":120,"props":165,"children":166},{},[],{"type":45,"tag":124,"props":168,"children":170},{"id":169},"prefer-mcpnative-tools-over-cli",[171],{"type":51,"value":172},"Prefer MCP\u002Fnative tools over CLI",{"type":45,"tag":174,"props":175,"children":176},"table",{},[177,196],{"type":45,"tag":178,"props":179,"children":180},"thead",{},[181],{"type":45,"tag":182,"props":183,"children":184},"tr",{},[185,191],{"type":45,"tag":186,"props":187,"children":188},"th",{},[189],{"type":51,"value":190},"Task",{"type":45,"tag":186,"props":192,"children":193},{},[194],{"type":51,"value":195},"Prefer instead",{"type":45,"tag":197,"props":198,"children":199},"tbody",{},[200,218,235,252],{"type":45,"tag":182,"props":201,"children":202},{},[203,209],{"type":45,"tag":204,"props":205,"children":206},"td",{},[207],{"type":51,"value":208},"ES|QL queries",{"type":45,"tag":204,"props":210,"children":211},{},[212],{"type":45,"tag":60,"props":213,"children":215},{"className":214},[],[216],{"type":51,"value":217},"eab_platform_core_execute_esql",{"type":45,"tag":182,"props":219,"children":220},{},[221,226],{"type":45,"tag":204,"props":222,"children":223},{},[224],{"type":51,"value":225},"Index\u002Fdatastream listing",{"type":45,"tag":204,"props":227,"children":228},{},[229],{"type":45,"tag":60,"props":230,"children":232},{"className":231},[],[233],{"type":51,"value":234},"eab_platform_core_list_indices",{"type":45,"tag":182,"props":236,"children":237},{},[238,243],{"type":45,"tag":204,"props":239,"children":240},{},[241],{"type":51,"value":242},"Streams",{"type":45,"tag":204,"props":244,"children":245},{},[246],{"type":45,"tag":60,"props":247,"children":249},{"className":248},[],[250],{"type":51,"value":251},"eab_platform_streams_*",{"type":45,"tag":182,"props":253,"children":254},{},[255,260],{"type":45,"tag":204,"props":256,"children":257},{},[258],{"type":51,"value":259},"Agent builder",{"type":45,"tag":204,"props":261,"children":262},{},[263,269,270],{"type":45,"tag":60,"props":264,"children":266},{"className":265},[],[267],{"type":51,"value":268},"kibana_list_agents",{"type":51,"value":148},{"type":45,"tag":60,"props":271,"children":273},{"className":272},[],[274],{"type":51,"value":275},"kibana_list_tools",{"type":45,"tag":120,"props":277,"children":278},{},[],{"type":45,"tag":124,"props":280,"children":282},{"id":281},"gotchas",[283],{"type":51,"value":284},"Gotchas",{"type":45,"tag":286,"props":287,"children":289},"h3",{"id":288},"serverless-many-cluster-apis-return-410",[290],{"type":51,"value":291},"Serverless: many cluster APIs return 410",{"type":45,"tag":54,"props":293,"children":294},{},[295],{"type":51,"value":296},"These all fail on serverless with \"not available in serverless mode\":",{"type":45,"tag":298,"props":299,"children":300},"ul",{},[301,326],{"type":45,"tag":302,"props":303,"children":304},"li",{},[305,311,313,319,320],{"type":45,"tag":60,"props":306,"children":308},{"className":307},[],[309],{"type":51,"value":310},"es cluster health",{"type":51,"value":312}," \u002F ",{"type":45,"tag":60,"props":314,"children":316},{"className":315},[],[317],{"type":51,"value":318},"stats",{"type":51,"value":312},{"type":45,"tag":60,"props":321,"children":323},{"className":322},[],[324],{"type":51,"value":325},"get-settings",{"type":45,"tag":302,"props":327,"children":328},{},[329,335,336],{"type":45,"tag":60,"props":330,"children":332},{"className":331},[],[333],{"type":51,"value":334},"es ilm get-lifecycle",{"type":51,"value":312},{"type":45,"tag":60,"props":337,"children":339},{"className":338},[],[340],{"type":51,"value":341},"get-status",{"type":45,"tag":54,"props":343,"children":344},{},[345,346,352],{"type":51,"value":58},{"type":45,"tag":60,"props":347,"children":349},{"className":348},[],[350],{"type":51,"value":351},"es cat count --json",{"type":51,"value":353}," to verify connectivity on serverless instead.",{"type":45,"tag":286,"props":355,"children":357},{"id":356},"es-indices-list-does-not-exist",[358,364],{"type":45,"tag":60,"props":359,"children":361},{"className":360},[],[362],{"type":51,"value":363},"es indices list",{"type":51,"value":365}," does not exist",{"type":45,"tag":54,"props":367,"children":368},{},[369,370,376,377,383],{"type":51,"value":58},{"type":45,"tag":60,"props":371,"children":373},{"className":372},[],[374],{"type":51,"value":375},"es indices get --index \"*\" --json",{"type":51,"value":110},{"type":45,"tag":60,"props":378,"children":380},{"className":379},[],[381],{"type":51,"value":382},"es indices get-data-stream --json",{"type":51,"value":118},{"type":45,"tag":286,"props":385,"children":387},{"id":386},"es-cluster-health-report-does-not-exist",[388,394],{"type":45,"tag":60,"props":389,"children":391},{"className":390},[],[392],{"type":51,"value":393},"es cluster health-report",{"type":51,"value":365},{"type":45,"tag":54,"props":396,"children":397},{},[398,400,405,407,413],{"type":51,"value":399},"The subcommand is ",{"type":45,"tag":60,"props":401,"children":403},{"className":402},[],[404],{"type":51,"value":310},{"type":51,"value":406},". There is no ",{"type":45,"tag":60,"props":408,"children":410},{"className":409},[],[411],{"type":51,"value":412},"health-report",{"type":51,"value":118},{"type":45,"tag":286,"props":415,"children":417},{"id":416},"agent-builder-subcommands-use-verbose-rest-style-names",[418],{"type":51,"value":419},"Agent builder subcommands use verbose REST-style names",{"type":45,"tag":54,"props":421,"children":422},{},[423,429,431,437,439,445],{"type":45,"tag":60,"props":424,"children":426},{"className":425},[],[427],{"type":51,"value":428},"kb agent-builder agents list",{"type":51,"value":430}," and ",{"type":45,"tag":60,"props":432,"children":434},{"className":433},[],[435],{"type":51,"value":436},"tools list",{"type":51,"value":438}," do ",{"type":45,"tag":440,"props":441,"children":442},"strong",{},[443],{"type":51,"value":444},"not",{"type":51,"value":446}," exist. Real commands:",{"type":45,"tag":448,"props":449,"children":453},"pre",{"className":450,"code":452,"language":51},[451],"language-text","kb agent-builder get-agent-builder-agents --json\nkb agent-builder get-agent-builder-tools --json\n",[454],{"type":45,"tag":60,"props":455,"children":457},{"__ignoreMap":456},"",[458],{"type":51,"value":452},{"type":45,"tag":54,"props":460,"children":461},{},[462,464,470,472,477],{"type":51,"value":463},"Pattern: ",{"type":45,"tag":60,"props":465,"children":467},{"className":466},[],[468],{"type":51,"value":469},"\u003Chttp-method>-\u003Cresource-path>",{"type":51,"value":471}," throughout all of ",{"type":45,"tag":60,"props":473,"children":475},{"className":474},[],[476],{"type":51,"value":154},{"type":51,"value":118},{"type":45,"tag":286,"props":479,"children":481},{"id":480},"docs-search-and-docs-read-require-named-flags-not-positional-args",[482,488,489,495],{"type":45,"tag":60,"props":483,"children":485},{"className":484},[],[486],{"type":51,"value":487},"docs search",{"type":51,"value":430},{"type":45,"tag":60,"props":490,"children":492},{"className":491},[],[493],{"type":51,"value":494},"docs read",{"type":51,"value":496}," require named flags, not positional args",{"type":45,"tag":448,"props":498,"children":501},{"className":499,"code":500,"language":51},[451],"# WRONG — \"too many arguments\" error\n[\"docs\",\"search\",\"index lifecycle management\"]\n[\"docs\",\"read\",\"https:\u002F\u002Fwww.elastic.co\u002F...\"]\n\n# CORRECT\n[\"docs\",\"search\",\"--query\",\"index lifecycle management\"]\n[\"docs\",\"read\",\"--path\",\"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002F...\"]\n",[502],{"type":45,"tag":60,"props":503,"children":504},{"__ignoreMap":456},[505],{"type":51,"value":500},{"type":45,"tag":54,"props":507,"children":508},{},[509,511,517,519,525,527,533],{"type":51,"value":510},"Also: old ",{"type":45,"tag":60,"props":512,"children":514},{"className":513},[],[515],{"type":51,"value":516},"\u002Fguide\u002F",{"type":51,"value":518}," URLs return ",{"type":45,"tag":60,"props":520,"children":522},{"className":521},[],[523],{"type":51,"value":524},"(no output)",{"type":51,"value":526},". Use ",{"type":45,"tag":60,"props":528,"children":530},{"className":529},[],[531],{"type":51,"value":532},"elastic.co\u002Fdocs\u002F",{"type":51,"value":534}," URLs.",{"type":45,"tag":286,"props":536,"children":538},{"id":537},"es-esql-query-requires-query-flag-not-positional",[539,545,547,553],{"type":45,"tag":60,"props":540,"children":542},{"className":541},[],[543],{"type":51,"value":544},"es esql query",{"type":51,"value":546}," requires ",{"type":45,"tag":60,"props":548,"children":550},{"className":549},[],[551],{"type":51,"value":552},"--query",{"type":51,"value":554}," flag, not positional",{"type":45,"tag":448,"props":556,"children":559},{"className":557,"code":558,"language":51},[451],"# WRONG\n[\"es\",\"esql\",\"query\",\"FROM logs-* | LIMIT 1\"]\n\n# CORRECT\n[\"es\",\"esql\",\"query\",\"--query\",\"FROM logs-* | LIMIT 1\",\"--json\"]\n",[560],{"type":45,"tag":60,"props":561,"children":562},{"__ignoreMap":456},[563],{"type":51,"value":558},{"type":45,"tag":286,"props":565,"children":567},{"id":566},"kb-slo-find-slos-op-requires-space-id",[568,574,575],{"type":45,"tag":60,"props":569,"children":571},{"className":570},[],[572],{"type":51,"value":573},"kb slo find-slos-op",{"type":51,"value":546},{"type":45,"tag":60,"props":576,"children":578},{"className":577},[],[579],{"type":51,"value":580},"--space-id",{"type":45,"tag":54,"props":582,"children":583},{},[584,586,592],{"type":51,"value":585},"Omitting it returns a validation error. Use ",{"type":45,"tag":60,"props":587,"children":589},{"className":588},[],[590],{"type":51,"value":591},"--space-id default",{"type":51,"value":118},{"type":45,"tag":286,"props":594,"children":596},{"id":595},"output-fields-and-output-template-are-per-subcommand-flags-placed-at-end",[597,603,604,610],{"type":45,"tag":60,"props":598,"children":600},{"className":599},[],[601],{"type":51,"value":602},"--output-fields",{"type":51,"value":430},{"type":45,"tag":60,"props":605,"children":607},{"className":606},[],[608],{"type":51,"value":609},"--output-template",{"type":51,"value":611}," are per-subcommand flags (placed at end)",{"type":45,"tag":54,"props":613,"children":614},{},[615,617,622,624,630,632,637,639,645],{"type":51,"value":616},"They are listed as global flags in the help but must come after the full subcommand.\n",{"type":45,"tag":60,"props":618,"children":620},{"className":619},[],[621],{"type":51,"value":602},{"type":51,"value":623}," returns ",{"type":45,"tag":60,"props":625,"children":627},{"className":626},[],[628],{"type":51,"value":629},"{}",{"type":51,"value":631}," for array responses — unreliable, avoid it.\n",{"type":45,"tag":60,"props":633,"children":635},{"className":634},[],[636],{"type":51,"value":609},{"type":51,"value":638}," only works for top-level scalar fields.\nJust use ",{"type":45,"tag":60,"props":640,"children":642},{"className":641},[],[643],{"type":51,"value":644},"--json",{"type":51,"value":646}," and process the output.",{"type":45,"tag":286,"props":648,"children":650},{"id":649},"never-block-on-stdin",[651],{"type":51,"value":652},"Never block on stdin",{"type":45,"tag":54,"props":654,"children":655},{},[656,658,664,665,671,673,678],{"type":51,"value":657},"Never use ",{"type":45,"tag":60,"props":659,"children":661},{"className":660},[],[662],{"type":51,"value":663},"--input-file \u002Fdev\u002Fstdin",{"type":51,"value":110},{"type":45,"tag":60,"props":666,"children":668},{"className":667},[],[669],{"type":51,"value":670},"es helpers watch",{"type":51,"value":672},". These block forever\nand hang the ",{"type":45,"tag":60,"props":674,"children":676},{"className":675},[],[677],{"type":51,"value":65},{"type":51,"value":679}," tool with no way to cancel.",{"items":681,"total":849},[682,701,716,729,748,760,770,785,797,812,823,836],{"slug":683,"name":683,"fn":684,"description":685,"org":686,"tags":687,"stars":698,"repoUrl":699,"updatedAt":700},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[688,691,694,695],{"name":689,"slug":690,"type":15},"Analytics","analytics",{"name":692,"slug":693,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":696,"slug":697,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":702,"name":702,"fn":703,"description":704,"org":705,"tags":706,"stars":698,"repoUrl":699,"updatedAt":715},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[707,708,709,712],{"name":24,"slug":25,"type":15},{"name":9,"slug":8,"type":15},{"name":710,"slug":711,"type":15},"Engineering","engineering",{"name":713,"slug":714,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":717,"name":717,"fn":718,"description":719,"org":720,"tags":721,"stars":698,"repoUrl":699,"updatedAt":728},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[722,723,724,725],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":696,"slug":697,"type":15},{"name":726,"slug":727,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":730,"name":730,"fn":731,"description":732,"org":733,"tags":734,"stars":745,"repoUrl":746,"updatedAt":747},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[735,738,739,742],{"name":736,"slug":737,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":740,"slug":741,"type":15},"Operations","operations",{"name":743,"slug":744,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":749,"name":749,"fn":750,"description":751,"org":752,"tags":753,"stars":745,"repoUrl":746,"updatedAt":759},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[754,755,758],{"name":736,"slug":737,"type":15},{"name":756,"slug":757,"type":15},"Deployment","deployment",{"name":21,"slug":22,"type":15},"2026-07-12T07:46:42.353362",{"slug":761,"name":761,"fn":762,"description":763,"org":764,"tags":765,"stars":745,"repoUrl":746,"updatedAt":769},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[766,767,768],{"name":736,"slug":737,"type":15},{"name":21,"slug":22,"type":15},{"name":740,"slug":741,"type":15},"2026-07-12T07:46:41.097412",{"slug":771,"name":771,"fn":772,"description":773,"org":774,"tags":775,"stars":745,"repoUrl":746,"updatedAt":784},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[776,777,778,781],{"name":736,"slug":737,"type":15},{"name":21,"slug":22,"type":15},{"name":779,"slug":780,"type":15},"Networking","networking",{"name":782,"slug":783,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":786,"name":786,"fn":787,"description":788,"org":789,"tags":790,"stars":745,"repoUrl":746,"updatedAt":796},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[791,794,795],{"name":792,"slug":793,"type":15},"Authentication","authentication",{"name":736,"slug":737,"type":15},{"name":21,"slug":22,"type":15},"2026-07-12T07:46:39.783105",{"slug":798,"name":798,"fn":799,"description":800,"org":801,"tags":802,"stars":745,"repoUrl":746,"updatedAt":811},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[803,806,807,810],{"name":804,"slug":805,"type":15},"Audit","audit",{"name":21,"slug":22,"type":15},{"name":808,"slug":809,"type":15},"Logs","logs",{"name":782,"slug":783,"type":15},"2026-07-12T07:47:35.092599",{"slug":813,"name":813,"fn":814,"description":815,"org":816,"tags":817,"stars":745,"repoUrl":746,"updatedAt":822},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[818,819,820,821],{"name":792,"slug":793,"type":15},{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":782,"slug":783,"type":15},"2026-07-12T07:47:41.474547",{"slug":824,"name":824,"fn":825,"description":826,"org":827,"tags":828,"stars":745,"repoUrl":746,"updatedAt":835},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[829,830,831,834],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":832,"slug":833,"type":15},"RBAC","rbac",{"name":782,"slug":783,"type":15},"2026-07-12T07:47:36.394177",{"slug":837,"name":837,"fn":838,"description":839,"org":840,"tags":841,"stars":745,"repoUrl":746,"updatedAt":848},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[842,843,844,845],{"name":689,"slug":690,"type":15},{"name":692,"slug":693,"type":15},{"name":21,"slug":22,"type":15},{"name":846,"slug":847,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":851,"total":885},[852,860,873],{"slug":4,"name":4,"fn":5,"description":6,"org":853,"tags":854,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[855,856,857,858,859],{"name":13,"slug":14,"type":15},{"name":24,"slug":25,"type":15},{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":18,"slug":19,"type":15},{"slug":861,"name":861,"fn":862,"description":863,"org":864,"tags":865,"stars":26,"repoUrl":27,"updatedAt":872},"observability-rca","perform root cause analysis on Elastic incidents","Use this skill when performing root cause analysis on incidents detected by Elastic Observability. Activate when the user reports a production issue, outage, degraded performance, or asks to investigate alerts.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[866,867,868,869],{"name":24,"slug":25,"type":15},{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},{"name":870,"slug":871,"type":15},"Observability","observability","2026-07-12T07:49:43.695963",{"slug":874,"name":874,"fn":875,"description":876,"org":877,"tags":878,"stars":26,"repoUrl":27,"updatedAt":884},"slo-management","manage Elastic Service Level Objectives","Use this skill when working with Elastic SLOs (Service Level Objectives). Activate when the user asks about SLO status, burn rates, error budgets, or needs to create and manage SLO definitions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[879,880,883],{"name":9,"slug":8,"type":15},{"name":881,"slug":882,"type":15},"Monitoring","monitoring",{"name":870,"slug":871,"type":15},"2026-07-12T07:49:41.13997",3]