[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-manage-alerts":3,"mdc--x2pcza-key":33,"related-org-elastic-manage-alerts":2166,"related-repo-elastic-manage-alerts":2338},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":31,"mdContent":32},"manage-alerts","manage Kibana alerting rules","CRUD for Kibana alerting rules — create, list, get, or delete custom-threshold rules. Use when the user says \"alert me when\", \"create a rule for\", \"page me if\", \"set up an alert\", \"show me my rules\", \"what alerts do I have\", \"delete that alert\", \"remove the rule\". Backend-agnostic — works on any metric field in any index pattern (metrics-*, logs-*, traces-apm*, custom). For transient session-scoped monitoring use `observe` instead. Requires Kibana with the Alerting feature enabled — the tool is auto-disabled when no Kibana URL is configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Alerting","alerting","tag",{"name":17,"slug":18,"type":15},"Monitoring","monitoring",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Kibana","kibana",10,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-observability","2026-07-12T07:49:21.846108",null,7,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":26},[],"https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-observability\u002Ftree\u002FHEAD\u002Fskills\u002Fmanage-alerts","---\nname: manage-alerts\ndescription: >\n  CRUD for Kibana alerting rules — create, list, get, or delete custom-threshold rules. Use when the\n  user says \"alert me when\", \"create a rule for\", \"page me if\", \"set up an alert\", \"show me my rules\",\n  \"what alerts do I have\", \"delete that alert\", \"remove the rule\". Backend-agnostic — works on any\n  metric field in any index pattern (metrics-*, logs-*, traces-apm*, custom). For transient\n  session-scoped monitoring use `observe` instead. Requires Kibana with the Alerting feature enabled —\n  the tool is auto-disabled when no Kibana URL is configured.\n---\n\n# Manage Alerts\n\nCRUD for **real, persistent Kibana alerting rules** — saved objects that keep running after the MCP\nsession ends, evaluate on their schedule, and (if connected to actions) notify via Slack, email,\nwebhook, etc. Rules created through this tool are tagged `elastic-o11y-mcp` by default so they're\neasy to find and clean up.\n\n## Prerequisites\n\n- **Kibana with Alerting enabled.** No specific backend — works on any numeric metric field in any\n  index pattern.\n- **Tool gating.** This tool only registers when the operator has explicitly set a Kibana URL in the\n  MCP install config. If `kibana_url` is blank the tool doesn't appear in the LLM's tool catalog at\n  all — a deliberate feature so operators can run the server strictly read-only (no rule creation,\n  and more importantly no rule deletion). If the user can't see `manage-alerts`, their server is\n  read-only on purpose.\n- A notification connector must be attached separately in Kibana for rules that should page someone.\n  Without an action, rules fire silently (visible in Kibana → Alerts & Insights).\n\n## Operations\n\n| Operation  | Purpose                                              |\n|------------|------------------------------------------------------|\n| `create`   | Create a new persistent custom-threshold rule.       |\n| `list`     | List rules, optionally filtered by tags\u002Fname\u002Ftype.   |\n| `get`      | Fetch a single rule by id, with execution status.    |\n| `delete`   | Permanently remove a rule by id. Irreversible.       |\n\n## When to use this vs `observe`\n\n| Use `manage-alerts` (create) when... | Use `observe` when... |\n|--------------------------------------|---------------------|\n| User wants durable alerting (\"page me from now on\") | User wants one-off monitoring (\"for the next 10 min\") |\n| Rule should keep running after session ends | Rule only matters inside the current conversation |\n| An operator should be paged out-of-band | The agent is validating a remediation in real time |\n| The threshold is well-understood | The threshold is still being calibrated |\n\nIf the user is still calibrating, suggest `observe` first — don't create durable rules until the\nthreshold is validated.\n\n## operation='create'\n\n```json\n{\n  \"operation\": \"create\",\n  \"rule_name\": \"Frontend Pod Memory > 80MB\",\n  \"metric_field\": \"k8s.pod.memory.working_set\",\n  \"threshold\": 80000000,\n  \"comparator\": \">\",\n  \"kql_filter\": \"kubernetes.namespace: otel-demo AND service.name: frontend\",\n  \"check_interval\": \"5m\",\n  \"agg_type\": \"avg\",\n  \"time_size\": 5,\n  \"time_unit\": \"m\",\n  \"index_pattern\": \"metrics-*\"\n}\n```\n\nParameter-filling guidance:\n\n- **`rule_name`**: derive from user intent — make it descriptive and specific. Bad: \"Memory rule.\"\n  Good: \"Frontend Pod Memory > 80MB (otel-demo).\"\n- **`metric_field`**: a real numeric field present in the index. Don't guess — if the user names a\n  metric vaguely (\"memory\"), ask which field or cross-reference with `apm-health-summary` output first.\n- **`threshold`**: in the field's native units. 80 MB as a `working_set` is `80000000` (bytes), not\n  `80`. Always clarify units.\n- **`comparator`**: default `>`. Use `\u003C` for low-watermark rules (\"fire if free memory drops below\").\n- **`kql_filter`**: narrow the scope — without a filter the rule applies to every document in the\n  index. Strongly recommended for shared environments.\n- **`check_interval`**: default `5m` (matches Kibana's own default and pairs with the 5m lookback).\n  Use `1m` only for pageable SLO breaches where the extra reactivity is worth the cycles; `15m`–`1h`\n  for capacity or trend rules.\n- **`agg_type`**: default `avg`. Use `max` for worst-case (p99-ish), `count` for event frequency.\n- **`time_size` + `time_unit`**: the aggregation window. Default 5m. Wider windows smooth; narrow\n  windows react fast but can be noisy.\n- **`index_pattern`**: default `metrics-*`. Override for `logs-*`, `traces-apm*`, or custom indices.\n\n## operation='list'\n\n```json\n{\n  \"operation\": \"list\",\n  \"search\": \"memory\",\n  \"per_page\": 50\n}\n```\n\n- **`tags`**: **omit by default** — the tool returns every alert rule in Kibana. Only pass\n  `[\"elastic-o11y-mcp\"]` when the user qualifies the request as scoped to this app:\n  - \"what rules did I create here \u002F from this app\" → `tags: [\"elastic-o11y-mcp\"]`\n  - \"show me my alerts\" \u002F \"what alerts do I have\" \u002F \"list all rules\" → omit (show everything)\n  - The view itself has a one-click toggle between \"all rules\" and \"MCP-created rules\", so users\n    can switch without re-prompting. Don't pre-filter unless they asked.\n- **`search`**: optional substring match against rule name.\n- **`rule_type_ids`**: optional filter — e.g. `[\"observability.rules.custom_threshold\"]`. Omit to\n  include every rule type.\n- **`per_page`** \u002F **`page`**: standard pagination. Default 50 per page.\n\nResponse includes a `rules` array with a compact summary (name, condition, status, tags) per rule,\nand the view renders each as a card with Inspect \u002F Delete buttons.\n\n## operation='get'\n\n```json\n{ \"operation\": \"get\", \"rule_id\": \"c5f2e1b8-...\" }\n```\n\nReturns the full rule definition plus execution status. Typical chain: `list` → user picks one → `get`.\n\n## operation='delete'\n\n**Two-step flow, enforced in the tool itself.** The tool refuses to delete anything without an\nexplicit `confirm: true` — on the first call you get a preview back, then you re-invoke with\n`confirm: true` after the user approves.\n\n**Step 1 — preview (omit `confirm` or pass `confirm: false`):**\n\n```json\n{ \"operation\": \"delete\", \"rule_id\": \"c5f2e1b8-...\" }\n```\n\nResponse shape: `{ operation: \"delete\", deleted: false, confirmation_required: true, preview: {...} }`.\nThe `preview` contains the full rule summary (name, condition, tags, etc.). Nothing has been deleted\nyet — the tool only fetched the rule.\n\nYour job on seeing a preview:\n\n1. **Quote the rule name (not just the id) back to the user.** \"Delete rule 'Frontend Pod Memory >\n   80MB' (id c5f2…)? This is irreversible.\"\n2. **Wait for explicit approval.** \"yes\", \"go ahead\", \"delete it\" — not a vague \"sure\".\n3. **If the user approves, dispatch Step 2. If they decline or hesitate, do nothing.**\n\n**Step 2 — confirmed delete (pass `confirm: true`):**\n\n```json\n{ \"operation\": \"delete\", \"rule_id\": \"c5f2e1b8-...\", \"confirm\": true }\n```\n\nOnly call this after the user has explicitly approved in the current turn. The Kibana saved object\nis gone the moment the API returns 204; there is no undo.\n\n**Never** pass `confirm: true` on the first invocation from a vague instruction like \"clean up the\nalerts\". Always `list` first, preview each candidate, and confirm before every delete.\n\n**Never** batch-delete multiple rules in one exchange unless the user has explicitly authorized it\nwith specific IDs or a clear scope (\"delete all three of those\").\n\n## After the tool returns\n\nAll operations emit a common response envelope:\n- `status`: `\"success\" | \"error\"`.\n- `operation`: echoes the operation for view rendering.\n- `message`: human-readable summary.\n- `investigation_actions`: click-to-send next-step prompts (chain to `list`, `get`, `delete`, or\n  `observe` as appropriate).\n\nIgnore `_setup_notice` if present — it's view-side chrome (welcome banner) that the UI handles. Don't\necho or summarize it in chat.\n\n`create` additionally returns `rule_id` and `cleanup_hint` (a one-line DELETE instruction plus the\nequivalent `manage-alerts` call).\n\n`list` returns `total`, `returned`, `page`, and a `rules` array.\n\n`get` returns the full rule as `rule` (summary) and `raw_rule` (unfiltered Kibana response).\n\n`delete` returns `rule_id` and `deleted: true`.\n\nThe MCP App view renders the appropriate layout per operation: a created-rule card for `create`, a\ndetail card for `get`, a list of rule cards with Inspect\u002FDelete buttons for `list`, and a deletion\nconfirmation for `delete`.\n\nConfirm to the user after each operation:\n\n- **create**: quote the rule name and condition. Mention Kibana → Alerts & Insights → Rules. If no\n  actions are attached, say so: \"this rule fires but doesn't notify anyone yet — attach an action in\n  Kibana to page Slack\u002Femail\u002Fwebhook.\" Offer the cleanup hint.\n- **list**: how many rules were found and what filter was applied. If you defaulted to the\n  `elastic-o11y-mcp` tag, mention that the user can pass `tags: []` to see everything.\n- **get**: summarize the rule's state — enabled\u002Fdisabled, last execution, active alert count.\n- **delete**: confirm the deletion and suggest a follow-up `list` to verify.\n\n## Key principles\n\n- **These are persistent, real saved objects.** Always confirm the rule name and condition back to\n  the user after `create` and `delete`.\n- **Attach a KQL filter on `create`.** Unfiltered rules against `metrics-*` evaluate across\n  everything — a recipe for noise and false alerts.\n- **Units matter.** Bytes vs MB vs percentage — always be explicit about the threshold's units.\n- **Default `list` to ALL rules.** Unqualified prompts (\"show me my alerts\", \"what alerts do I have\")\n  return every rule in Kibana — that's almost always what the user wants when they ask broadly.\n  Apply `tags: [\"elastic-o11y-mcp\"]` only when they qualify with \"this app\" \u002F \"rules I created here\"\n  \u002F similar. The view has a one-click toggle for users to switch states without a re-prompt.\n- **Confirm before deleting.** The delete path is irreversible; quote the rule name, wait for\n  explicit approval.\n- **If the tool isn't available, the operator disabled it on purpose.** Don't suggest workarounds to\n  create rules via raw ES \u002F Kibana API calls — respect the read-only posture.\n",{"data":34,"body":35},{"name":4,"description":6},{"type":36,"children":37},"root",[38,46,69,76,121,127,223,235,322,334,340,776,781,1028,1034,1152,1267,1280,1286,1369,1388,1394,1419,1443,1521,1542,1547,1579,1593,1696,1701,1725,1734,1740,1745,1823,1836,1868,1906,1932,1954,1986,1991,2052,2058,2160],{"type":39,"tag":40,"props":41,"children":42},"element","h1",{"id":4},[43],{"type":44,"value":45},"text","Manage Alerts",{"type":39,"tag":47,"props":48,"children":49},"p",{},[50,52,58,60,67],{"type":44,"value":51},"CRUD for ",{"type":39,"tag":53,"props":54,"children":55},"strong",{},[56],{"type":44,"value":57},"real, persistent Kibana alerting rules",{"type":44,"value":59}," — saved objects that keep running after the MCP\nsession ends, evaluate on their schedule, and (if connected to actions) notify via Slack, email,\nwebhook, etc. Rules created through this tool are tagged ",{"type":39,"tag":61,"props":62,"children":64},"code",{"className":63},[],[65],{"type":44,"value":66},"elastic-o11y-mcp",{"type":44,"value":68}," by default so they're\neasy to find and clean up.",{"type":39,"tag":70,"props":71,"children":73},"h2",{"id":72},"prerequisites",[74],{"type":44,"value":75},"Prerequisites",{"type":39,"tag":77,"props":78,"children":79},"ul",{},[80,91,116],{"type":39,"tag":81,"props":82,"children":83},"li",{},[84,89],{"type":39,"tag":53,"props":85,"children":86},{},[87],{"type":44,"value":88},"Kibana with Alerting enabled.",{"type":44,"value":90}," No specific backend — works on any numeric metric field in any\nindex pattern.",{"type":39,"tag":81,"props":92,"children":93},{},[94,99,101,107,109,114],{"type":39,"tag":53,"props":95,"children":96},{},[97],{"type":44,"value":98},"Tool gating.",{"type":44,"value":100}," This tool only registers when the operator has explicitly set a Kibana URL in the\nMCP install config. If ",{"type":39,"tag":61,"props":102,"children":104},{"className":103},[],[105],{"type":44,"value":106},"kibana_url",{"type":44,"value":108}," is blank the tool doesn't appear in the LLM's tool catalog at\nall — a deliberate feature so operators can run the server strictly read-only (no rule creation,\nand more importantly no rule deletion). If the user can't see ",{"type":39,"tag":61,"props":110,"children":112},{"className":111},[],[113],{"type":44,"value":4},{"type":44,"value":115},", their server is\nread-only on purpose.",{"type":39,"tag":81,"props":117,"children":118},{},[119],{"type":44,"value":120},"A notification connector must be attached separately in Kibana for rules that should page someone.\nWithout an action, rules fire silently (visible in Kibana → Alerts & Insights).",{"type":39,"tag":70,"props":122,"children":124},{"id":123},"operations",[125],{"type":44,"value":126},"Operations",{"type":39,"tag":128,"props":129,"children":130},"table",{},[131,150],{"type":39,"tag":132,"props":133,"children":134},"thead",{},[135],{"type":39,"tag":136,"props":137,"children":138},"tr",{},[139,145],{"type":39,"tag":140,"props":141,"children":142},"th",{},[143],{"type":44,"value":144},"Operation",{"type":39,"tag":140,"props":146,"children":147},{},[148],{"type":44,"value":149},"Purpose",{"type":39,"tag":151,"props":152,"children":153},"tbody",{},[154,172,189,206],{"type":39,"tag":136,"props":155,"children":156},{},[157,167],{"type":39,"tag":158,"props":159,"children":160},"td",{},[161],{"type":39,"tag":61,"props":162,"children":164},{"className":163},[],[165],{"type":44,"value":166},"create",{"type":39,"tag":158,"props":168,"children":169},{},[170],{"type":44,"value":171},"Create a new persistent custom-threshold rule.",{"type":39,"tag":136,"props":173,"children":174},{},[175,184],{"type":39,"tag":158,"props":176,"children":177},{},[178],{"type":39,"tag":61,"props":179,"children":181},{"className":180},[],[182],{"type":44,"value":183},"list",{"type":39,"tag":158,"props":185,"children":186},{},[187],{"type":44,"value":188},"List rules, optionally filtered by tags\u002Fname\u002Ftype.",{"type":39,"tag":136,"props":190,"children":191},{},[192,201],{"type":39,"tag":158,"props":193,"children":194},{},[195],{"type":39,"tag":61,"props":196,"children":198},{"className":197},[],[199],{"type":44,"value":200},"get",{"type":39,"tag":158,"props":202,"children":203},{},[204],{"type":44,"value":205},"Fetch a single rule by id, with execution status.",{"type":39,"tag":136,"props":207,"children":208},{},[209,218],{"type":39,"tag":158,"props":210,"children":211},{},[212],{"type":39,"tag":61,"props":213,"children":215},{"className":214},[],[216],{"type":44,"value":217},"delete",{"type":39,"tag":158,"props":219,"children":220},{},[221],{"type":44,"value":222},"Permanently remove a rule by id. Irreversible.",{"type":39,"tag":70,"props":224,"children":226},{"id":225},"when-to-use-this-vs-observe",[227,229],{"type":44,"value":228},"When to use this vs ",{"type":39,"tag":61,"props":230,"children":232},{"className":231},[],[233],{"type":44,"value":234},"observe",{"type":39,"tag":128,"props":236,"children":237},{},[238,267],{"type":39,"tag":132,"props":239,"children":240},{},[241],{"type":39,"tag":136,"props":242,"children":243},{},[244,256],{"type":39,"tag":140,"props":245,"children":246},{},[247,249,254],{"type":44,"value":248},"Use ",{"type":39,"tag":61,"props":250,"children":252},{"className":251},[],[253],{"type":44,"value":4},{"type":44,"value":255}," (create) when...",{"type":39,"tag":140,"props":257,"children":258},{},[259,260,265],{"type":44,"value":248},{"type":39,"tag":61,"props":261,"children":263},{"className":262},[],[264],{"type":44,"value":234},{"type":44,"value":266}," when...",{"type":39,"tag":151,"props":268,"children":269},{},[270,283,296,309],{"type":39,"tag":136,"props":271,"children":272},{},[273,278],{"type":39,"tag":158,"props":274,"children":275},{},[276],{"type":44,"value":277},"User wants durable alerting (\"page me from now on\")",{"type":39,"tag":158,"props":279,"children":280},{},[281],{"type":44,"value":282},"User wants one-off monitoring (\"for the next 10 min\")",{"type":39,"tag":136,"props":284,"children":285},{},[286,291],{"type":39,"tag":158,"props":287,"children":288},{},[289],{"type":44,"value":290},"Rule should keep running after session ends",{"type":39,"tag":158,"props":292,"children":293},{},[294],{"type":44,"value":295},"Rule only matters inside the current conversation",{"type":39,"tag":136,"props":297,"children":298},{},[299,304],{"type":39,"tag":158,"props":300,"children":301},{},[302],{"type":44,"value":303},"An operator should be paged out-of-band",{"type":39,"tag":158,"props":305,"children":306},{},[307],{"type":44,"value":308},"The agent is validating a remediation in real time",{"type":39,"tag":136,"props":310,"children":311},{},[312,317],{"type":39,"tag":158,"props":313,"children":314},{},[315],{"type":44,"value":316},"The threshold is well-understood",{"type":39,"tag":158,"props":318,"children":319},{},[320],{"type":44,"value":321},"The threshold is still being calibrated",{"type":39,"tag":47,"props":323,"children":324},{},[325,327,332],{"type":44,"value":326},"If the user is still calibrating, suggest ",{"type":39,"tag":61,"props":328,"children":330},{"className":329},[],[331],{"type":44,"value":234},{"type":44,"value":333}," first — don't create durable rules until the\nthreshold is validated.",{"type":39,"tag":70,"props":335,"children":337},{"id":336},"operationcreate",[338],{"type":44,"value":339},"operation='create'",{"type":39,"tag":341,"props":342,"children":347},"pre",{"className":343,"code":344,"language":345,"meta":346,"style":346},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"operation\": \"create\",\n  \"rule_name\": \"Frontend Pod Memory > 80MB\",\n  \"metric_field\": \"k8s.pod.memory.working_set\",\n  \"threshold\": 80000000,\n  \"comparator\": \">\",\n  \"kql_filter\": \"kubernetes.namespace: otel-demo AND service.name: frontend\",\n  \"check_interval\": \"5m\",\n  \"agg_type\": \"avg\",\n  \"time_size\": 5,\n  \"time_unit\": \"m\",\n  \"index_pattern\": \"metrics-*\"\n}\n","json","",[348],{"type":39,"tag":61,"props":349,"children":350},{"__ignoreMap":346},[351,363,407,445,483,514,552,589,627,665,694,732,767],{"type":39,"tag":352,"props":353,"children":356},"span",{"class":354,"line":355},"line",1,[357],{"type":39,"tag":352,"props":358,"children":360},{"style":359},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[361],{"type":44,"value":362},"{\n",{"type":39,"tag":352,"props":364,"children":366},{"class":354,"line":365},2,[367,372,378,383,388,393,398,402],{"type":39,"tag":352,"props":368,"children":369},{"style":359},[370],{"type":44,"value":371},"  \"",{"type":39,"tag":352,"props":373,"children":375},{"style":374},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[376],{"type":44,"value":377},"operation",{"type":39,"tag":352,"props":379,"children":380},{"style":359},[381],{"type":44,"value":382},"\"",{"type":39,"tag":352,"props":384,"children":385},{"style":359},[386],{"type":44,"value":387},":",{"type":39,"tag":352,"props":389,"children":390},{"style":359},[391],{"type":44,"value":392}," \"",{"type":39,"tag":352,"props":394,"children":396},{"style":395},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[397],{"type":44,"value":166},{"type":39,"tag":352,"props":399,"children":400},{"style":359},[401],{"type":44,"value":382},{"type":39,"tag":352,"props":403,"children":404},{"style":359},[405],{"type":44,"value":406},",\n",{"type":39,"tag":352,"props":408,"children":410},{"class":354,"line":409},3,[411,415,420,424,428,432,437,441],{"type":39,"tag":352,"props":412,"children":413},{"style":359},[414],{"type":44,"value":371},{"type":39,"tag":352,"props":416,"children":417},{"style":374},[418],{"type":44,"value":419},"rule_name",{"type":39,"tag":352,"props":421,"children":422},{"style":359},[423],{"type":44,"value":382},{"type":39,"tag":352,"props":425,"children":426},{"style":359},[427],{"type":44,"value":387},{"type":39,"tag":352,"props":429,"children":430},{"style":359},[431],{"type":44,"value":392},{"type":39,"tag":352,"props":433,"children":434},{"style":395},[435],{"type":44,"value":436},"Frontend Pod Memory > 80MB",{"type":39,"tag":352,"props":438,"children":439},{"style":359},[440],{"type":44,"value":382},{"type":39,"tag":352,"props":442,"children":443},{"style":359},[444],{"type":44,"value":406},{"type":39,"tag":352,"props":446,"children":448},{"class":354,"line":447},4,[449,453,458,462,466,470,475,479],{"type":39,"tag":352,"props":450,"children":451},{"style":359},[452],{"type":44,"value":371},{"type":39,"tag":352,"props":454,"children":455},{"style":374},[456],{"type":44,"value":457},"metric_field",{"type":39,"tag":352,"props":459,"children":460},{"style":359},[461],{"type":44,"value":382},{"type":39,"tag":352,"props":463,"children":464},{"style":359},[465],{"type":44,"value":387},{"type":39,"tag":352,"props":467,"children":468},{"style":359},[469],{"type":44,"value":392},{"type":39,"tag":352,"props":471,"children":472},{"style":395},[473],{"type":44,"value":474},"k8s.pod.memory.working_set",{"type":39,"tag":352,"props":476,"children":477},{"style":359},[478],{"type":44,"value":382},{"type":39,"tag":352,"props":480,"children":481},{"style":359},[482],{"type":44,"value":406},{"type":39,"tag":352,"props":484,"children":486},{"class":354,"line":485},5,[487,491,496,500,504,510],{"type":39,"tag":352,"props":488,"children":489},{"style":359},[490],{"type":44,"value":371},{"type":39,"tag":352,"props":492,"children":493},{"style":374},[494],{"type":44,"value":495},"threshold",{"type":39,"tag":352,"props":497,"children":498},{"style":359},[499],{"type":44,"value":382},{"type":39,"tag":352,"props":501,"children":502},{"style":359},[503],{"type":44,"value":387},{"type":39,"tag":352,"props":505,"children":507},{"style":506},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[508],{"type":44,"value":509}," 80000000",{"type":39,"tag":352,"props":511,"children":512},{"style":359},[513],{"type":44,"value":406},{"type":39,"tag":352,"props":515,"children":517},{"class":354,"line":516},6,[518,522,527,531,535,539,544,548],{"type":39,"tag":352,"props":519,"children":520},{"style":359},[521],{"type":44,"value":371},{"type":39,"tag":352,"props":523,"children":524},{"style":374},[525],{"type":44,"value":526},"comparator",{"type":39,"tag":352,"props":528,"children":529},{"style":359},[530],{"type":44,"value":382},{"type":39,"tag":352,"props":532,"children":533},{"style":359},[534],{"type":44,"value":387},{"type":39,"tag":352,"props":536,"children":537},{"style":359},[538],{"type":44,"value":392},{"type":39,"tag":352,"props":540,"children":541},{"style":395},[542],{"type":44,"value":543},">",{"type":39,"tag":352,"props":545,"children":546},{"style":359},[547],{"type":44,"value":382},{"type":39,"tag":352,"props":549,"children":550},{"style":359},[551],{"type":44,"value":406},{"type":39,"tag":352,"props":553,"children":554},{"class":354,"line":27},[555,559,564,568,572,576,581,585],{"type":39,"tag":352,"props":556,"children":557},{"style":359},[558],{"type":44,"value":371},{"type":39,"tag":352,"props":560,"children":561},{"style":374},[562],{"type":44,"value":563},"kql_filter",{"type":39,"tag":352,"props":565,"children":566},{"style":359},[567],{"type":44,"value":382},{"type":39,"tag":352,"props":569,"children":570},{"style":359},[571],{"type":44,"value":387},{"type":39,"tag":352,"props":573,"children":574},{"style":359},[575],{"type":44,"value":392},{"type":39,"tag":352,"props":577,"children":578},{"style":395},[579],{"type":44,"value":580},"kubernetes.namespace: otel-demo AND service.name: frontend",{"type":39,"tag":352,"props":582,"children":583},{"style":359},[584],{"type":44,"value":382},{"type":39,"tag":352,"props":586,"children":587},{"style":359},[588],{"type":44,"value":406},{"type":39,"tag":352,"props":590,"children":592},{"class":354,"line":591},8,[593,597,602,606,610,614,619,623],{"type":39,"tag":352,"props":594,"children":595},{"style":359},[596],{"type":44,"value":371},{"type":39,"tag":352,"props":598,"children":599},{"style":374},[600],{"type":44,"value":601},"check_interval",{"type":39,"tag":352,"props":603,"children":604},{"style":359},[605],{"type":44,"value":382},{"type":39,"tag":352,"props":607,"children":608},{"style":359},[609],{"type":44,"value":387},{"type":39,"tag":352,"props":611,"children":612},{"style":359},[613],{"type":44,"value":392},{"type":39,"tag":352,"props":615,"children":616},{"style":395},[617],{"type":44,"value":618},"5m",{"type":39,"tag":352,"props":620,"children":621},{"style":359},[622],{"type":44,"value":382},{"type":39,"tag":352,"props":624,"children":625},{"style":359},[626],{"type":44,"value":406},{"type":39,"tag":352,"props":628,"children":630},{"class":354,"line":629},9,[631,635,640,644,648,652,657,661],{"type":39,"tag":352,"props":632,"children":633},{"style":359},[634],{"type":44,"value":371},{"type":39,"tag":352,"props":636,"children":637},{"style":374},[638],{"type":44,"value":639},"agg_type",{"type":39,"tag":352,"props":641,"children":642},{"style":359},[643],{"type":44,"value":382},{"type":39,"tag":352,"props":645,"children":646},{"style":359},[647],{"type":44,"value":387},{"type":39,"tag":352,"props":649,"children":650},{"style":359},[651],{"type":44,"value":392},{"type":39,"tag":352,"props":653,"children":654},{"style":395},[655],{"type":44,"value":656},"avg",{"type":39,"tag":352,"props":658,"children":659},{"style":359},[660],{"type":44,"value":382},{"type":39,"tag":352,"props":662,"children":663},{"style":359},[664],{"type":44,"value":406},{"type":39,"tag":352,"props":666,"children":667},{"class":354,"line":23},[668,672,677,681,685,690],{"type":39,"tag":352,"props":669,"children":670},{"style":359},[671],{"type":44,"value":371},{"type":39,"tag":352,"props":673,"children":674},{"style":374},[675],{"type":44,"value":676},"time_size",{"type":39,"tag":352,"props":678,"children":679},{"style":359},[680],{"type":44,"value":382},{"type":39,"tag":352,"props":682,"children":683},{"style":359},[684],{"type":44,"value":387},{"type":39,"tag":352,"props":686,"children":687},{"style":506},[688],{"type":44,"value":689}," 5",{"type":39,"tag":352,"props":691,"children":692},{"style":359},[693],{"type":44,"value":406},{"type":39,"tag":352,"props":695,"children":697},{"class":354,"line":696},11,[698,702,707,711,715,719,724,728],{"type":39,"tag":352,"props":699,"children":700},{"style":359},[701],{"type":44,"value":371},{"type":39,"tag":352,"props":703,"children":704},{"style":374},[705],{"type":44,"value":706},"time_unit",{"type":39,"tag":352,"props":708,"children":709},{"style":359},[710],{"type":44,"value":382},{"type":39,"tag":352,"props":712,"children":713},{"style":359},[714],{"type":44,"value":387},{"type":39,"tag":352,"props":716,"children":717},{"style":359},[718],{"type":44,"value":392},{"type":39,"tag":352,"props":720,"children":721},{"style":395},[722],{"type":44,"value":723},"m",{"type":39,"tag":352,"props":725,"children":726},{"style":359},[727],{"type":44,"value":382},{"type":39,"tag":352,"props":729,"children":730},{"style":359},[731],{"type":44,"value":406},{"type":39,"tag":352,"props":733,"children":735},{"class":354,"line":734},12,[736,740,745,749,753,757,762],{"type":39,"tag":352,"props":737,"children":738},{"style":359},[739],{"type":44,"value":371},{"type":39,"tag":352,"props":741,"children":742},{"style":374},[743],{"type":44,"value":744},"index_pattern",{"type":39,"tag":352,"props":746,"children":747},{"style":359},[748],{"type":44,"value":382},{"type":39,"tag":352,"props":750,"children":751},{"style":359},[752],{"type":44,"value":387},{"type":39,"tag":352,"props":754,"children":755},{"style":359},[756],{"type":44,"value":392},{"type":39,"tag":352,"props":758,"children":759},{"style":395},[760],{"type":44,"value":761},"metrics-*",{"type":39,"tag":352,"props":763,"children":764},{"style":359},[765],{"type":44,"value":766},"\"\n",{"type":39,"tag":352,"props":768,"children":770},{"class":354,"line":769},13,[771],{"type":39,"tag":352,"props":772,"children":773},{"style":359},[774],{"type":44,"value":775},"}\n",{"type":39,"tag":47,"props":777,"children":778},{},[779],{"type":44,"value":780},"Parameter-filling guidance:",{"type":39,"tag":77,"props":782,"children":783},{},[784,797,818,855,883,896,939,973,993],{"type":39,"tag":81,"props":785,"children":786},{},[787,795],{"type":39,"tag":53,"props":788,"children":789},{},[790],{"type":39,"tag":61,"props":791,"children":793},{"className":792},[],[794],{"type":44,"value":419},{"type":44,"value":796},": derive from user intent — make it descriptive and specific. Bad: \"Memory rule.\"\nGood: \"Frontend Pod Memory > 80MB (otel-demo).\"",{"type":39,"tag":81,"props":798,"children":799},{},[800,808,810,816],{"type":39,"tag":53,"props":801,"children":802},{},[803],{"type":39,"tag":61,"props":804,"children":806},{"className":805},[],[807],{"type":44,"value":457},{"type":44,"value":809},": a real numeric field present in the index. Don't guess — if the user names a\nmetric vaguely (\"memory\"), ask which field or cross-reference with ",{"type":39,"tag":61,"props":811,"children":813},{"className":812},[],[814],{"type":44,"value":815},"apm-health-summary",{"type":44,"value":817}," output first.",{"type":39,"tag":81,"props":819,"children":820},{},[821,829,831,837,839,845,847,853],{"type":39,"tag":53,"props":822,"children":823},{},[824],{"type":39,"tag":61,"props":825,"children":827},{"className":826},[],[828],{"type":44,"value":495},{"type":44,"value":830},": in the field's native units. 80 MB as a ",{"type":39,"tag":61,"props":832,"children":834},{"className":833},[],[835],{"type":44,"value":836},"working_set",{"type":44,"value":838}," is ",{"type":39,"tag":61,"props":840,"children":842},{"className":841},[],[843],{"type":44,"value":844},"80000000",{"type":44,"value":846}," (bytes), not\n",{"type":39,"tag":61,"props":848,"children":850},{"className":849},[],[851],{"type":44,"value":852},"80",{"type":44,"value":854},". Always clarify units.",{"type":39,"tag":81,"props":856,"children":857},{},[858,866,868,873,875,881],{"type":39,"tag":53,"props":859,"children":860},{},[861],{"type":39,"tag":61,"props":862,"children":864},{"className":863},[],[865],{"type":44,"value":526},{"type":44,"value":867},": default ",{"type":39,"tag":61,"props":869,"children":871},{"className":870},[],[872],{"type":44,"value":543},{"type":44,"value":874},". Use ",{"type":39,"tag":61,"props":876,"children":878},{"className":877},[],[879],{"type":44,"value":880},"\u003C",{"type":44,"value":882}," for low-watermark rules (\"fire if free memory drops below\").",{"type":39,"tag":81,"props":884,"children":885},{},[886,894],{"type":39,"tag":53,"props":887,"children":888},{},[889],{"type":39,"tag":61,"props":890,"children":892},{"className":891},[],[893],{"type":44,"value":563},{"type":44,"value":895},": narrow the scope — without a filter the rule applies to every document in the\nindex. Strongly recommended for shared environments.",{"type":39,"tag":81,"props":897,"children":898},{},[899,907,908,913,915,921,923,929,931,937],{"type":39,"tag":53,"props":900,"children":901},{},[902],{"type":39,"tag":61,"props":903,"children":905},{"className":904},[],[906],{"type":44,"value":601},{"type":44,"value":867},{"type":39,"tag":61,"props":909,"children":911},{"className":910},[],[912],{"type":44,"value":618},{"type":44,"value":914}," (matches Kibana's own default and pairs with the 5m lookback).\nUse ",{"type":39,"tag":61,"props":916,"children":918},{"className":917},[],[919],{"type":44,"value":920},"1m",{"type":44,"value":922}," only for pageable SLO breaches where the extra reactivity is worth the cycles; ",{"type":39,"tag":61,"props":924,"children":926},{"className":925},[],[927],{"type":44,"value":928},"15m",{"type":44,"value":930},"–",{"type":39,"tag":61,"props":932,"children":934},{"className":933},[],[935],{"type":44,"value":936},"1h",{"type":44,"value":938},"\nfor capacity or trend rules.",{"type":39,"tag":81,"props":940,"children":941},{},[942,950,951,956,957,963,965,971],{"type":39,"tag":53,"props":943,"children":944},{},[945],{"type":39,"tag":61,"props":946,"children":948},{"className":947},[],[949],{"type":44,"value":639},{"type":44,"value":867},{"type":39,"tag":61,"props":952,"children":954},{"className":953},[],[955],{"type":44,"value":656},{"type":44,"value":874},{"type":39,"tag":61,"props":958,"children":960},{"className":959},[],[961],{"type":44,"value":962},"max",{"type":44,"value":964}," for worst-case (p99-ish), ",{"type":39,"tag":61,"props":966,"children":968},{"className":967},[],[969],{"type":44,"value":970},"count",{"type":44,"value":972}," for event frequency.",{"type":39,"tag":81,"props":974,"children":975},{},[976,991],{"type":39,"tag":53,"props":977,"children":978},{},[979,984,986],{"type":39,"tag":61,"props":980,"children":982},{"className":981},[],[983],{"type":44,"value":676},{"type":44,"value":985}," + ",{"type":39,"tag":61,"props":987,"children":989},{"className":988},[],[990],{"type":44,"value":706},{"type":44,"value":992},": the aggregation window. Default 5m. Wider windows smooth; narrow\nwindows react fast but can be noisy.",{"type":39,"tag":81,"props":994,"children":995},{},[996,1004,1005,1010,1012,1018,1020,1026],{"type":39,"tag":53,"props":997,"children":998},{},[999],{"type":39,"tag":61,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":44,"value":744},{"type":44,"value":867},{"type":39,"tag":61,"props":1006,"children":1008},{"className":1007},[],[1009],{"type":44,"value":761},{"type":44,"value":1011},". Override for ",{"type":39,"tag":61,"props":1013,"children":1015},{"className":1014},[],[1016],{"type":44,"value":1017},"logs-*",{"type":44,"value":1019},", ",{"type":39,"tag":61,"props":1021,"children":1023},{"className":1022},[],[1024],{"type":44,"value":1025},"traces-apm*",{"type":44,"value":1027},", or custom indices.",{"type":39,"tag":70,"props":1029,"children":1031},{"id":1030},"operationlist",[1032],{"type":44,"value":1033},"operation='list'",{"type":39,"tag":341,"props":1035,"children":1037},{"className":343,"code":1036,"language":345,"meta":346,"style":346},"{\n  \"operation\": \"list\",\n  \"search\": \"memory\",\n  \"per_page\": 50\n}\n",[1038],{"type":39,"tag":61,"props":1039,"children":1040},{"__ignoreMap":346},[1041,1048,1083,1120,1145],{"type":39,"tag":352,"props":1042,"children":1043},{"class":354,"line":355},[1044],{"type":39,"tag":352,"props":1045,"children":1046},{"style":359},[1047],{"type":44,"value":362},{"type":39,"tag":352,"props":1049,"children":1050},{"class":354,"line":365},[1051,1055,1059,1063,1067,1071,1075,1079],{"type":39,"tag":352,"props":1052,"children":1053},{"style":359},[1054],{"type":44,"value":371},{"type":39,"tag":352,"props":1056,"children":1057},{"style":374},[1058],{"type":44,"value":377},{"type":39,"tag":352,"props":1060,"children":1061},{"style":359},[1062],{"type":44,"value":382},{"type":39,"tag":352,"props":1064,"children":1065},{"style":359},[1066],{"type":44,"value":387},{"type":39,"tag":352,"props":1068,"children":1069},{"style":359},[1070],{"type":44,"value":392},{"type":39,"tag":352,"props":1072,"children":1073},{"style":395},[1074],{"type":44,"value":183},{"type":39,"tag":352,"props":1076,"children":1077},{"style":359},[1078],{"type":44,"value":382},{"type":39,"tag":352,"props":1080,"children":1081},{"style":359},[1082],{"type":44,"value":406},{"type":39,"tag":352,"props":1084,"children":1085},{"class":354,"line":409},[1086,1090,1095,1099,1103,1107,1112,1116],{"type":39,"tag":352,"props":1087,"children":1088},{"style":359},[1089],{"type":44,"value":371},{"type":39,"tag":352,"props":1091,"children":1092},{"style":374},[1093],{"type":44,"value":1094},"search",{"type":39,"tag":352,"props":1096,"children":1097},{"style":359},[1098],{"type":44,"value":382},{"type":39,"tag":352,"props":1100,"children":1101},{"style":359},[1102],{"type":44,"value":387},{"type":39,"tag":352,"props":1104,"children":1105},{"style":359},[1106],{"type":44,"value":392},{"type":39,"tag":352,"props":1108,"children":1109},{"style":395},[1110],{"type":44,"value":1111},"memory",{"type":39,"tag":352,"props":1113,"children":1114},{"style":359},[1115],{"type":44,"value":382},{"type":39,"tag":352,"props":1117,"children":1118},{"style":359},[1119],{"type":44,"value":406},{"type":39,"tag":352,"props":1121,"children":1122},{"class":354,"line":447},[1123,1127,1132,1136,1140],{"type":39,"tag":352,"props":1124,"children":1125},{"style":359},[1126],{"type":44,"value":371},{"type":39,"tag":352,"props":1128,"children":1129},{"style":374},[1130],{"type":44,"value":1131},"per_page",{"type":39,"tag":352,"props":1133,"children":1134},{"style":359},[1135],{"type":44,"value":382},{"type":39,"tag":352,"props":1137,"children":1138},{"style":359},[1139],{"type":44,"value":387},{"type":39,"tag":352,"props":1141,"children":1142},{"style":506},[1143],{"type":44,"value":1144}," 50\n",{"type":39,"tag":352,"props":1146,"children":1147},{"class":354,"line":485},[1148],{"type":39,"tag":352,"props":1149,"children":1150},{"style":359},[1151],{"type":44,"value":775},{"type":39,"tag":77,"props":1153,"children":1154},{},[1155,1208,1221,1243],{"type":39,"tag":81,"props":1156,"children":1157},{},[1158,1167,1169,1174,1176,1182,1184],{"type":39,"tag":53,"props":1159,"children":1160},{},[1161],{"type":39,"tag":61,"props":1162,"children":1164},{"className":1163},[],[1165],{"type":44,"value":1166},"tags",{"type":44,"value":1168},": ",{"type":39,"tag":53,"props":1170,"children":1171},{},[1172],{"type":44,"value":1173},"omit by default",{"type":44,"value":1175}," — the tool returns every alert rule in Kibana. Only pass\n",{"type":39,"tag":61,"props":1177,"children":1179},{"className":1178},[],[1180],{"type":44,"value":1181},"[\"elastic-o11y-mcp\"]",{"type":44,"value":1183}," when the user qualifies the request as scoped to this app:\n",{"type":39,"tag":77,"props":1185,"children":1186},{},[1187,1198,1203],{"type":39,"tag":81,"props":1188,"children":1189},{},[1190,1192],{"type":44,"value":1191},"\"what rules did I create here \u002F from this app\" → ",{"type":39,"tag":61,"props":1193,"children":1195},{"className":1194},[],[1196],{"type":44,"value":1197},"tags: [\"elastic-o11y-mcp\"]",{"type":39,"tag":81,"props":1199,"children":1200},{},[1201],{"type":44,"value":1202},"\"show me my alerts\" \u002F \"what alerts do I have\" \u002F \"list all rules\" → omit (show everything)",{"type":39,"tag":81,"props":1204,"children":1205},{},[1206],{"type":44,"value":1207},"The view itself has a one-click toggle between \"all rules\" and \"MCP-created rules\", so users\ncan switch without re-prompting. Don't pre-filter unless they asked.",{"type":39,"tag":81,"props":1209,"children":1210},{},[1211,1219],{"type":39,"tag":53,"props":1212,"children":1213},{},[1214],{"type":39,"tag":61,"props":1215,"children":1217},{"className":1216},[],[1218],{"type":44,"value":1094},{"type":44,"value":1220},": optional substring match against rule name.",{"type":39,"tag":81,"props":1222,"children":1223},{},[1224,1233,1235,1241],{"type":39,"tag":53,"props":1225,"children":1226},{},[1227],{"type":39,"tag":61,"props":1228,"children":1230},{"className":1229},[],[1231],{"type":44,"value":1232},"rule_type_ids",{"type":44,"value":1234},": optional filter — e.g. ",{"type":39,"tag":61,"props":1236,"children":1238},{"className":1237},[],[1239],{"type":44,"value":1240},"[\"observability.rules.custom_threshold\"]",{"type":44,"value":1242},". Omit to\ninclude every rule type.",{"type":39,"tag":81,"props":1244,"children":1245},{},[1246,1254,1256,1265],{"type":39,"tag":53,"props":1247,"children":1248},{},[1249],{"type":39,"tag":61,"props":1250,"children":1252},{"className":1251},[],[1253],{"type":44,"value":1131},{"type":44,"value":1255}," \u002F ",{"type":39,"tag":53,"props":1257,"children":1258},{},[1259],{"type":39,"tag":61,"props":1260,"children":1262},{"className":1261},[],[1263],{"type":44,"value":1264},"page",{"type":44,"value":1266},": standard pagination. Default 50 per page.",{"type":39,"tag":47,"props":1268,"children":1269},{},[1270,1272,1278],{"type":44,"value":1271},"Response includes a ",{"type":39,"tag":61,"props":1273,"children":1275},{"className":1274},[],[1276],{"type":44,"value":1277},"rules",{"type":44,"value":1279}," array with a compact summary (name, condition, status, tags) per rule,\nand the view renders each as a card with Inspect \u002F Delete buttons.",{"type":39,"tag":70,"props":1281,"children":1283},{"id":1282},"operationget",[1284],{"type":44,"value":1285},"operation='get'",{"type":39,"tag":341,"props":1287,"children":1289},{"className":343,"code":1288,"language":345,"meta":346,"style":346},"{ \"operation\": \"get\", \"rule_id\": \"c5f2e1b8-...\" }\n",[1290],{"type":39,"tag":61,"props":1291,"children":1292},{"__ignoreMap":346},[1293],{"type":39,"tag":352,"props":1294,"children":1295},{"class":354,"line":355},[1296,1301,1305,1309,1313,1317,1321,1325,1329,1334,1338,1343,1347,1351,1355,1360,1364],{"type":39,"tag":352,"props":1297,"children":1298},{"style":359},[1299],{"type":44,"value":1300},"{",{"type":39,"tag":352,"props":1302,"children":1303},{"style":359},[1304],{"type":44,"value":392},{"type":39,"tag":352,"props":1306,"children":1307},{"style":374},[1308],{"type":44,"value":377},{"type":39,"tag":352,"props":1310,"children":1311},{"style":359},[1312],{"type":44,"value":382},{"type":39,"tag":352,"props":1314,"children":1315},{"style":359},[1316],{"type":44,"value":387},{"type":39,"tag":352,"props":1318,"children":1319},{"style":359},[1320],{"type":44,"value":392},{"type":39,"tag":352,"props":1322,"children":1323},{"style":395},[1324],{"type":44,"value":200},{"type":39,"tag":352,"props":1326,"children":1327},{"style":359},[1328],{"type":44,"value":382},{"type":39,"tag":352,"props":1330,"children":1331},{"style":359},[1332],{"type":44,"value":1333},",",{"type":39,"tag":352,"props":1335,"children":1336},{"style":359},[1337],{"type":44,"value":392},{"type":39,"tag":352,"props":1339,"children":1340},{"style":374},[1341],{"type":44,"value":1342},"rule_id",{"type":39,"tag":352,"props":1344,"children":1345},{"style":359},[1346],{"type":44,"value":382},{"type":39,"tag":352,"props":1348,"children":1349},{"style":359},[1350],{"type":44,"value":387},{"type":39,"tag":352,"props":1352,"children":1353},{"style":359},[1354],{"type":44,"value":392},{"type":39,"tag":352,"props":1356,"children":1357},{"style":395},[1358],{"type":44,"value":1359},"c5f2e1b8-...",{"type":39,"tag":352,"props":1361,"children":1362},{"style":359},[1363],{"type":44,"value":382},{"type":39,"tag":352,"props":1365,"children":1366},{"style":359},[1367],{"type":44,"value":1368}," }\n",{"type":39,"tag":47,"props":1370,"children":1371},{},[1372,1374,1379,1381,1386],{"type":44,"value":1373},"Returns the full rule definition plus execution status. Typical chain: ",{"type":39,"tag":61,"props":1375,"children":1377},{"className":1376},[],[1378],{"type":44,"value":183},{"type":44,"value":1380}," → user picks one → ",{"type":39,"tag":61,"props":1382,"children":1384},{"className":1383},[],[1385],{"type":44,"value":200},{"type":44,"value":1387},".",{"type":39,"tag":70,"props":1389,"children":1391},{"id":1390},"operationdelete",[1392],{"type":44,"value":1393},"operation='delete'",{"type":39,"tag":47,"props":1395,"children":1396},{},[1397,1402,1404,1410,1412,1417],{"type":39,"tag":53,"props":1398,"children":1399},{},[1400],{"type":44,"value":1401},"Two-step flow, enforced in the tool itself.",{"type":44,"value":1403}," The tool refuses to delete anything without an\nexplicit ",{"type":39,"tag":61,"props":1405,"children":1407},{"className":1406},[],[1408],{"type":44,"value":1409},"confirm: true",{"type":44,"value":1411}," — on the first call you get a preview back, then you re-invoke with\n",{"type":39,"tag":61,"props":1413,"children":1415},{"className":1414},[],[1416],{"type":44,"value":1409},{"type":44,"value":1418}," after the user approves.",{"type":39,"tag":47,"props":1420,"children":1421},{},[1422],{"type":39,"tag":53,"props":1423,"children":1424},{},[1425,1427,1433,1435,1441],{"type":44,"value":1426},"Step 1 — preview (omit ",{"type":39,"tag":61,"props":1428,"children":1430},{"className":1429},[],[1431],{"type":44,"value":1432},"confirm",{"type":44,"value":1434}," or pass ",{"type":39,"tag":61,"props":1436,"children":1438},{"className":1437},[],[1439],{"type":44,"value":1440},"confirm: false",{"type":44,"value":1442},"):",{"type":39,"tag":341,"props":1444,"children":1446},{"className":343,"code":1445,"language":345,"meta":346,"style":346},"{ \"operation\": \"delete\", \"rule_id\": \"c5f2e1b8-...\" }\n",[1447],{"type":39,"tag":61,"props":1448,"children":1449},{"__ignoreMap":346},[1450],{"type":39,"tag":352,"props":1451,"children":1452},{"class":354,"line":355},[1453,1457,1461,1465,1469,1473,1477,1481,1485,1489,1493,1497,1501,1505,1509,1513,1517],{"type":39,"tag":352,"props":1454,"children":1455},{"style":359},[1456],{"type":44,"value":1300},{"type":39,"tag":352,"props":1458,"children":1459},{"style":359},[1460],{"type":44,"value":392},{"type":39,"tag":352,"props":1462,"children":1463},{"style":374},[1464],{"type":44,"value":377},{"type":39,"tag":352,"props":1466,"children":1467},{"style":359},[1468],{"type":44,"value":382},{"type":39,"tag":352,"props":1470,"children":1471},{"style":359},[1472],{"type":44,"value":387},{"type":39,"tag":352,"props":1474,"children":1475},{"style":359},[1476],{"type":44,"value":392},{"type":39,"tag":352,"props":1478,"children":1479},{"style":395},[1480],{"type":44,"value":217},{"type":39,"tag":352,"props":1482,"children":1483},{"style":359},[1484],{"type":44,"value":382},{"type":39,"tag":352,"props":1486,"children":1487},{"style":359},[1488],{"type":44,"value":1333},{"type":39,"tag":352,"props":1490,"children":1491},{"style":359},[1492],{"type":44,"value":392},{"type":39,"tag":352,"props":1494,"children":1495},{"style":374},[1496],{"type":44,"value":1342},{"type":39,"tag":352,"props":1498,"children":1499},{"style":359},[1500],{"type":44,"value":382},{"type":39,"tag":352,"props":1502,"children":1503},{"style":359},[1504],{"type":44,"value":387},{"type":39,"tag":352,"props":1506,"children":1507},{"style":359},[1508],{"type":44,"value":392},{"type":39,"tag":352,"props":1510,"children":1511},{"style":395},[1512],{"type":44,"value":1359},{"type":39,"tag":352,"props":1514,"children":1515},{"style":359},[1516],{"type":44,"value":382},{"type":39,"tag":352,"props":1518,"children":1519},{"style":359},[1520],{"type":44,"value":1368},{"type":39,"tag":47,"props":1522,"children":1523},{},[1524,1526,1532,1534,1540],{"type":44,"value":1525},"Response shape: ",{"type":39,"tag":61,"props":1527,"children":1529},{"className":1528},[],[1530],{"type":44,"value":1531},"{ operation: \"delete\", deleted: false, confirmation_required: true, preview: {...} }",{"type":44,"value":1533},".\nThe ",{"type":39,"tag":61,"props":1535,"children":1537},{"className":1536},[],[1538],{"type":44,"value":1539},"preview",{"type":44,"value":1541}," contains the full rule summary (name, condition, tags, etc.). Nothing has been deleted\nyet — the tool only fetched the rule.",{"type":39,"tag":47,"props":1543,"children":1544},{},[1545],{"type":44,"value":1546},"Your job on seeing a preview:",{"type":39,"tag":1548,"props":1549,"children":1550},"ol",{},[1551,1561,1571],{"type":39,"tag":81,"props":1552,"children":1553},{},[1554,1559],{"type":39,"tag":53,"props":1555,"children":1556},{},[1557],{"type":44,"value":1558},"Quote the rule name (not just the id) back to the user.",{"type":44,"value":1560}," \"Delete rule 'Frontend Pod Memory >\n80MB' (id c5f2…)? This is irreversible.\"",{"type":39,"tag":81,"props":1562,"children":1563},{},[1564,1569],{"type":39,"tag":53,"props":1565,"children":1566},{},[1567],{"type":44,"value":1568},"Wait for explicit approval.",{"type":44,"value":1570}," \"yes\", \"go ahead\", \"delete it\" — not a vague \"sure\".",{"type":39,"tag":81,"props":1572,"children":1573},{},[1574],{"type":39,"tag":53,"props":1575,"children":1576},{},[1577],{"type":44,"value":1578},"If the user approves, dispatch Step 2. If they decline or hesitate, do nothing.",{"type":39,"tag":47,"props":1580,"children":1581},{},[1582],{"type":39,"tag":53,"props":1583,"children":1584},{},[1585,1587,1592],{"type":44,"value":1586},"Step 2 — confirmed delete (pass ",{"type":39,"tag":61,"props":1588,"children":1590},{"className":1589},[],[1591],{"type":44,"value":1409},{"type":44,"value":1442},{"type":39,"tag":341,"props":1594,"children":1596},{"className":343,"code":1595,"language":345,"meta":346,"style":346},"{ \"operation\": \"delete\", \"rule_id\": \"c5f2e1b8-...\", \"confirm\": true }\n",[1597],{"type":39,"tag":61,"props":1598,"children":1599},{"__ignoreMap":346},[1600],{"type":39,"tag":352,"props":1601,"children":1602},{"class":354,"line":355},[1603,1607,1611,1615,1619,1623,1627,1631,1635,1639,1643,1647,1651,1655,1659,1663,1667,1671,1675,1679,1683,1687,1692],{"type":39,"tag":352,"props":1604,"children":1605},{"style":359},[1606],{"type":44,"value":1300},{"type":39,"tag":352,"props":1608,"children":1609},{"style":359},[1610],{"type":44,"value":392},{"type":39,"tag":352,"props":1612,"children":1613},{"style":374},[1614],{"type":44,"value":377},{"type":39,"tag":352,"props":1616,"children":1617},{"style":359},[1618],{"type":44,"value":382},{"type":39,"tag":352,"props":1620,"children":1621},{"style":359},[1622],{"type":44,"value":387},{"type":39,"tag":352,"props":1624,"children":1625},{"style":359},[1626],{"type":44,"value":392},{"type":39,"tag":352,"props":1628,"children":1629},{"style":395},[1630],{"type":44,"value":217},{"type":39,"tag":352,"props":1632,"children":1633},{"style":359},[1634],{"type":44,"value":382},{"type":39,"tag":352,"props":1636,"children":1637},{"style":359},[1638],{"type":44,"value":1333},{"type":39,"tag":352,"props":1640,"children":1641},{"style":359},[1642],{"type":44,"value":392},{"type":39,"tag":352,"props":1644,"children":1645},{"style":374},[1646],{"type":44,"value":1342},{"type":39,"tag":352,"props":1648,"children":1649},{"style":359},[1650],{"type":44,"value":382},{"type":39,"tag":352,"props":1652,"children":1653},{"style":359},[1654],{"type":44,"value":387},{"type":39,"tag":352,"props":1656,"children":1657},{"style":359},[1658],{"type":44,"value":392},{"type":39,"tag":352,"props":1660,"children":1661},{"style":395},[1662],{"type":44,"value":1359},{"type":39,"tag":352,"props":1664,"children":1665},{"style":359},[1666],{"type":44,"value":382},{"type":39,"tag":352,"props":1668,"children":1669},{"style":359},[1670],{"type":44,"value":1333},{"type":39,"tag":352,"props":1672,"children":1673},{"style":359},[1674],{"type":44,"value":392},{"type":39,"tag":352,"props":1676,"children":1677},{"style":374},[1678],{"type":44,"value":1432},{"type":39,"tag":352,"props":1680,"children":1681},{"style":359},[1682],{"type":44,"value":382},{"type":39,"tag":352,"props":1684,"children":1685},{"style":359},[1686],{"type":44,"value":387},{"type":39,"tag":352,"props":1688,"children":1689},{"style":359},[1690],{"type":44,"value":1691}," true",{"type":39,"tag":352,"props":1693,"children":1694},{"style":359},[1695],{"type":44,"value":1368},{"type":39,"tag":47,"props":1697,"children":1698},{},[1699],{"type":44,"value":1700},"Only call this after the user has explicitly approved in the current turn. The Kibana saved object\nis gone the moment the API returns 204; there is no undo.",{"type":39,"tag":47,"props":1702,"children":1703},{},[1704,1709,1711,1716,1718,1723],{"type":39,"tag":53,"props":1705,"children":1706},{},[1707],{"type":44,"value":1708},"Never",{"type":44,"value":1710}," pass ",{"type":39,"tag":61,"props":1712,"children":1714},{"className":1713},[],[1715],{"type":44,"value":1409},{"type":44,"value":1717}," on the first invocation from a vague instruction like \"clean up the\nalerts\". Always ",{"type":39,"tag":61,"props":1719,"children":1721},{"className":1720},[],[1722],{"type":44,"value":183},{"type":44,"value":1724}," first, preview each candidate, and confirm before every delete.",{"type":39,"tag":47,"props":1726,"children":1727},{},[1728,1732],{"type":39,"tag":53,"props":1729,"children":1730},{},[1731],{"type":44,"value":1708},{"type":44,"value":1733}," batch-delete multiple rules in one exchange unless the user has explicitly authorized it\nwith specific IDs or a clear scope (\"delete all three of those\").",{"type":39,"tag":70,"props":1735,"children":1737},{"id":1736},"after-the-tool-returns",[1738],{"type":44,"value":1739},"After the tool returns",{"type":39,"tag":47,"props":1741,"children":1742},{},[1743],{"type":44,"value":1744},"All operations emit a common response envelope:",{"type":39,"tag":77,"props":1746,"children":1747},{},[1748,1765,1775,1786],{"type":39,"tag":81,"props":1749,"children":1750},{},[1751,1757,1758,1764],{"type":39,"tag":61,"props":1752,"children":1754},{"className":1753},[],[1755],{"type":44,"value":1756},"status",{"type":44,"value":1168},{"type":39,"tag":61,"props":1759,"children":1761},{"className":1760},[],[1762],{"type":44,"value":1763},"\"success\" | \"error\"",{"type":44,"value":1387},{"type":39,"tag":81,"props":1766,"children":1767},{},[1768,1773],{"type":39,"tag":61,"props":1769,"children":1771},{"className":1770},[],[1772],{"type":44,"value":377},{"type":44,"value":1774},": echoes the operation for view rendering.",{"type":39,"tag":81,"props":1776,"children":1777},{},[1778,1784],{"type":39,"tag":61,"props":1779,"children":1781},{"className":1780},[],[1782],{"type":44,"value":1783},"message",{"type":44,"value":1785},": human-readable summary.",{"type":39,"tag":81,"props":1787,"children":1788},{},[1789,1795,1797,1802,1803,1808,1809,1814,1816,1821],{"type":39,"tag":61,"props":1790,"children":1792},{"className":1791},[],[1793],{"type":44,"value":1794},"investigation_actions",{"type":44,"value":1796},": click-to-send next-step prompts (chain to ",{"type":39,"tag":61,"props":1798,"children":1800},{"className":1799},[],[1801],{"type":44,"value":183},{"type":44,"value":1019},{"type":39,"tag":61,"props":1804,"children":1806},{"className":1805},[],[1807],{"type":44,"value":200},{"type":44,"value":1019},{"type":39,"tag":61,"props":1810,"children":1812},{"className":1811},[],[1813],{"type":44,"value":217},{"type":44,"value":1815},", or\n",{"type":39,"tag":61,"props":1817,"children":1819},{"className":1818},[],[1820],{"type":44,"value":234},{"type":44,"value":1822}," as appropriate).",{"type":39,"tag":47,"props":1824,"children":1825},{},[1826,1828,1834],{"type":44,"value":1827},"Ignore ",{"type":39,"tag":61,"props":1829,"children":1831},{"className":1830},[],[1832],{"type":44,"value":1833},"_setup_notice",{"type":44,"value":1835}," if present — it's view-side chrome (welcome banner) that the UI handles. Don't\necho or summarize it in chat.",{"type":39,"tag":47,"props":1837,"children":1838},{},[1839,1844,1846,1851,1853,1859,1861,1866],{"type":39,"tag":61,"props":1840,"children":1842},{"className":1841},[],[1843],{"type":44,"value":166},{"type":44,"value":1845}," additionally returns ",{"type":39,"tag":61,"props":1847,"children":1849},{"className":1848},[],[1850],{"type":44,"value":1342},{"type":44,"value":1852}," and ",{"type":39,"tag":61,"props":1854,"children":1856},{"className":1855},[],[1857],{"type":44,"value":1858},"cleanup_hint",{"type":44,"value":1860}," (a one-line DELETE instruction plus the\nequivalent ",{"type":39,"tag":61,"props":1862,"children":1864},{"className":1863},[],[1865],{"type":44,"value":4},{"type":44,"value":1867}," call).",{"type":39,"tag":47,"props":1869,"children":1870},{},[1871,1876,1878,1884,1885,1891,1892,1897,1899,1904],{"type":39,"tag":61,"props":1872,"children":1874},{"className":1873},[],[1875],{"type":44,"value":183},{"type":44,"value":1877}," returns ",{"type":39,"tag":61,"props":1879,"children":1881},{"className":1880},[],[1882],{"type":44,"value":1883},"total",{"type":44,"value":1019},{"type":39,"tag":61,"props":1886,"children":1888},{"className":1887},[],[1889],{"type":44,"value":1890},"returned",{"type":44,"value":1019},{"type":39,"tag":61,"props":1893,"children":1895},{"className":1894},[],[1896],{"type":44,"value":1264},{"type":44,"value":1898},", and a ",{"type":39,"tag":61,"props":1900,"children":1902},{"className":1901},[],[1903],{"type":44,"value":1277},{"type":44,"value":1905}," array.",{"type":39,"tag":47,"props":1907,"children":1908},{},[1909,1914,1916,1922,1924,1930],{"type":39,"tag":61,"props":1910,"children":1912},{"className":1911},[],[1913],{"type":44,"value":200},{"type":44,"value":1915}," returns the full rule as ",{"type":39,"tag":61,"props":1917,"children":1919},{"className":1918},[],[1920],{"type":44,"value":1921},"rule",{"type":44,"value":1923}," (summary) and ",{"type":39,"tag":61,"props":1925,"children":1927},{"className":1926},[],[1928],{"type":44,"value":1929},"raw_rule",{"type":44,"value":1931}," (unfiltered Kibana response).",{"type":39,"tag":47,"props":1933,"children":1934},{},[1935,1940,1941,1946,1947,1953],{"type":39,"tag":61,"props":1936,"children":1938},{"className":1937},[],[1939],{"type":44,"value":217},{"type":44,"value":1877},{"type":39,"tag":61,"props":1942,"children":1944},{"className":1943},[],[1945],{"type":44,"value":1342},{"type":44,"value":1852},{"type":39,"tag":61,"props":1948,"children":1950},{"className":1949},[],[1951],{"type":44,"value":1952},"deleted: true",{"type":44,"value":1387},{"type":39,"tag":47,"props":1955,"children":1956},{},[1957,1959,1964,1966,1971,1973,1978,1980,1985],{"type":44,"value":1958},"The MCP App view renders the appropriate layout per operation: a created-rule card for ",{"type":39,"tag":61,"props":1960,"children":1962},{"className":1961},[],[1963],{"type":44,"value":166},{"type":44,"value":1965},", a\ndetail card for ",{"type":39,"tag":61,"props":1967,"children":1969},{"className":1968},[],[1970],{"type":44,"value":200},{"type":44,"value":1972},", a list of rule cards with Inspect\u002FDelete buttons for ",{"type":39,"tag":61,"props":1974,"children":1976},{"className":1975},[],[1977],{"type":44,"value":183},{"type":44,"value":1979},", and a deletion\nconfirmation for ",{"type":39,"tag":61,"props":1981,"children":1983},{"className":1982},[],[1984],{"type":44,"value":217},{"type":44,"value":1387},{"type":39,"tag":47,"props":1987,"children":1988},{},[1989],{"type":44,"value":1990},"Confirm to the user after each operation:",{"type":39,"tag":77,"props":1992,"children":1993},{},[1994,2003,2027,2036],{"type":39,"tag":81,"props":1995,"children":1996},{},[1997,2001],{"type":39,"tag":53,"props":1998,"children":1999},{},[2000],{"type":44,"value":166},{"type":44,"value":2002},": quote the rule name and condition. Mention Kibana → Alerts & Insights → Rules. If no\nactions are attached, say so: \"this rule fires but doesn't notify anyone yet — attach an action in\nKibana to page Slack\u002Femail\u002Fwebhook.\" Offer the cleanup hint.",{"type":39,"tag":81,"props":2004,"children":2005},{},[2006,2010,2012,2017,2019,2025],{"type":39,"tag":53,"props":2007,"children":2008},{},[2009],{"type":44,"value":183},{"type":44,"value":2011},": how many rules were found and what filter was applied. If you defaulted to the\n",{"type":39,"tag":61,"props":2013,"children":2015},{"className":2014},[],[2016],{"type":44,"value":66},{"type":44,"value":2018}," tag, mention that the user can pass ",{"type":39,"tag":61,"props":2020,"children":2022},{"className":2021},[],[2023],{"type":44,"value":2024},"tags: []",{"type":44,"value":2026}," to see everything.",{"type":39,"tag":81,"props":2028,"children":2029},{},[2030,2034],{"type":39,"tag":53,"props":2031,"children":2032},{},[2033],{"type":44,"value":200},{"type":44,"value":2035},": summarize the rule's state — enabled\u002Fdisabled, last execution, active alert count.",{"type":39,"tag":81,"props":2037,"children":2038},{},[2039,2043,2045,2050],{"type":39,"tag":53,"props":2040,"children":2041},{},[2042],{"type":44,"value":217},{"type":44,"value":2044},": confirm the deletion and suggest a follow-up ",{"type":39,"tag":61,"props":2046,"children":2048},{"className":2047},[],[2049],{"type":44,"value":183},{"type":44,"value":2051}," to verify.",{"type":39,"tag":70,"props":2053,"children":2055},{"id":2054},"key-principles",[2056],{"type":44,"value":2057},"Key principles",{"type":39,"tag":77,"props":2059,"children":2060},{},[2061,2083,2106,2116,2140,2150],{"type":39,"tag":81,"props":2062,"children":2063},{},[2064,2069,2071,2076,2077,2082],{"type":39,"tag":53,"props":2065,"children":2066},{},[2067],{"type":44,"value":2068},"These are persistent, real saved objects.",{"type":44,"value":2070}," Always confirm the rule name and condition back to\nthe user after ",{"type":39,"tag":61,"props":2072,"children":2074},{"className":2073},[],[2075],{"type":44,"value":166},{"type":44,"value":1852},{"type":39,"tag":61,"props":2078,"children":2080},{"className":2079},[],[2081],{"type":44,"value":217},{"type":44,"value":1387},{"type":39,"tag":81,"props":2084,"children":2085},{},[2086,2097,2099,2104],{"type":39,"tag":53,"props":2087,"children":2088},{},[2089,2091,2096],{"type":44,"value":2090},"Attach a KQL filter on ",{"type":39,"tag":61,"props":2092,"children":2094},{"className":2093},[],[2095],{"type":44,"value":166},{"type":44,"value":1387},{"type":44,"value":2098}," Unfiltered rules against ",{"type":39,"tag":61,"props":2100,"children":2102},{"className":2101},[],[2103],{"type":44,"value":761},{"type":44,"value":2105}," evaluate across\neverything — a recipe for noise and false alerts.",{"type":39,"tag":81,"props":2107,"children":2108},{},[2109,2114],{"type":39,"tag":53,"props":2110,"children":2111},{},[2112],{"type":44,"value":2113},"Units matter.",{"type":44,"value":2115}," Bytes vs MB vs percentage — always be explicit about the threshold's units.",{"type":39,"tag":81,"props":2117,"children":2118},{},[2119,2131,2133,2138],{"type":39,"tag":53,"props":2120,"children":2121},{},[2122,2124,2129],{"type":44,"value":2123},"Default ",{"type":39,"tag":61,"props":2125,"children":2127},{"className":2126},[],[2128],{"type":44,"value":183},{"type":44,"value":2130}," to ALL rules.",{"type":44,"value":2132}," Unqualified prompts (\"show me my alerts\", \"what alerts do I have\")\nreturn every rule in Kibana — that's almost always what the user wants when they ask broadly.\nApply ",{"type":39,"tag":61,"props":2134,"children":2136},{"className":2135},[],[2137],{"type":44,"value":1197},{"type":44,"value":2139}," only when they qualify with \"this app\" \u002F \"rules I created here\"\n\u002F similar. The view has a one-click toggle for users to switch states without a re-prompt.",{"type":39,"tag":81,"props":2141,"children":2142},{},[2143,2148],{"type":39,"tag":53,"props":2144,"children":2145},{},[2146],{"type":44,"value":2147},"Confirm before deleting.",{"type":44,"value":2149}," The delete path is irreversible; quote the rule name, wait for\nexplicit approval.",{"type":39,"tag":81,"props":2151,"children":2152},{},[2153,2158],{"type":39,"tag":53,"props":2154,"children":2155},{},[2156],{"type":44,"value":2157},"If the tool isn't available, the operator disabled it on purpose.",{"type":44,"value":2159}," Don't suggest workarounds to\ncreate rules via raw ES \u002F Kibana API calls — respect the read-only posture.",{"type":39,"tag":2161,"props":2162,"children":2163},"style",{},[2164],{"type":44,"value":2165},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2167,"total":2337},[2168,2187,2204,2219,2236,2248,2258,2273,2285,2300,2311,2324],{"slug":2169,"name":2169,"fn":2170,"description":2171,"org":2172,"tags":2173,"stars":2184,"repoUrl":2185,"updatedAt":2186},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2174,2177,2180,2181],{"name":2175,"slug":2176,"type":15},"Analytics","analytics",{"name":2178,"slug":2179,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":2182,"slug":2183,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":2188,"name":2188,"fn":2189,"description":2190,"org":2191,"tags":2192,"stars":2184,"repoUrl":2185,"updatedAt":2203},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2193,2196,2197,2200],{"name":2194,"slug":2195,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":2198,"slug":2199,"type":15},"Engineering","engineering",{"name":2201,"slug":2202,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":2205,"name":2205,"fn":2206,"description":2207,"org":2208,"tags":2209,"stars":2184,"repoUrl":2185,"updatedAt":2218},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2210,2211,2214,2215],{"name":9,"slug":8,"type":15},{"name":2212,"slug":2213,"type":15},"Elasticsearch","elasticsearch",{"name":2182,"slug":2183,"type":15},{"name":2216,"slug":2217,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":2220,"name":2220,"fn":2221,"description":2222,"org":2223,"tags":2224,"stars":2233,"repoUrl":2234,"updatedAt":2235},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2225,2228,2229,2230],{"name":2226,"slug":2227,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":126,"slug":123,"type":15},{"name":2231,"slug":2232,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":2237,"name":2237,"fn":2238,"description":2239,"org":2240,"tags":2241,"stars":2233,"repoUrl":2234,"updatedAt":2247},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2242,2243,2246],{"name":2226,"slug":2227,"type":15},{"name":2244,"slug":2245,"type":15},"Deployment","deployment",{"name":2212,"slug":2213,"type":15},"2026-07-12T07:46:42.353362",{"slug":2249,"name":2249,"fn":2250,"description":2251,"org":2252,"tags":2253,"stars":2233,"repoUrl":2234,"updatedAt":2257},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2254,2255,2256],{"name":2226,"slug":2227,"type":15},{"name":2212,"slug":2213,"type":15},{"name":126,"slug":123,"type":15},"2026-07-12T07:46:41.097412",{"slug":2259,"name":2259,"fn":2260,"description":2261,"org":2262,"tags":2263,"stars":2233,"repoUrl":2234,"updatedAt":2272},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2264,2265,2266,2269],{"name":2226,"slug":2227,"type":15},{"name":2212,"slug":2213,"type":15},{"name":2267,"slug":2268,"type":15},"Networking","networking",{"name":2270,"slug":2271,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":2274,"name":2274,"fn":2275,"description":2276,"org":2277,"tags":2278,"stars":2233,"repoUrl":2234,"updatedAt":2284},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2279,2282,2283],{"name":2280,"slug":2281,"type":15},"Authentication","authentication",{"name":2226,"slug":2227,"type":15},{"name":2212,"slug":2213,"type":15},"2026-07-12T07:46:39.783105",{"slug":2286,"name":2286,"fn":2287,"description":2288,"org":2289,"tags":2290,"stars":2233,"repoUrl":2234,"updatedAt":2299},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2291,2294,2295,2298],{"name":2292,"slug":2293,"type":15},"Audit","audit",{"name":2212,"slug":2213,"type":15},{"name":2296,"slug":2297,"type":15},"Logs","logs",{"name":2270,"slug":2271,"type":15},"2026-07-12T07:47:35.092599",{"slug":2301,"name":2301,"fn":2302,"description":2303,"org":2304,"tags":2305,"stars":2233,"repoUrl":2234,"updatedAt":2310},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2306,2307,2308,2309],{"name":2280,"slug":2281,"type":15},{"name":9,"slug":8,"type":15},{"name":2212,"slug":2213,"type":15},{"name":2270,"slug":2271,"type":15},"2026-07-12T07:47:41.474547",{"slug":2312,"name":2312,"fn":2313,"description":2314,"org":2315,"tags":2316,"stars":2233,"repoUrl":2234,"updatedAt":2323},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2317,2318,2319,2322],{"name":9,"slug":8,"type":15},{"name":2212,"slug":2213,"type":15},{"name":2320,"slug":2321,"type":15},"RBAC","rbac",{"name":2270,"slug":2271,"type":15},"2026-07-12T07:47:36.394177",{"slug":2325,"name":2325,"fn":2326,"description":2327,"org":2328,"tags":2329,"stars":2233,"repoUrl":2234,"updatedAt":2336},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2330,2331,2332,2333],{"name":2175,"slug":2176,"type":15},{"name":2178,"slug":2179,"type":15},{"name":2212,"slug":2213,"type":15},{"name":2334,"slug":2335,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":2339,"total":516},[2340,2354,2365,2380,2387,2402],{"slug":815,"name":815,"fn":2341,"description":2342,"org":2343,"tags":2344,"stars":23,"repoUrl":24,"updatedAt":2353},"summarize Elastic APM service health","Get a cluster-level rollup of service health from APM telemetry — the \"how's my environment right now?\" entry point for observability investigations. Use whenever the user asks about HEALTH, STATUS, or general wellbeing of an environment \u002F cluster \u002F namespace (\"how's my cluster\", \"status of the X env\", \"what's broken\", \"any issues\", \"show me the health of …\", \"give me a status report\", \"what should I look at\", \"things feel slow\"). This applies regardless of any time qualifier — \"show me the health of X over the past hour\" still routes here (with lookback=\"1h\"), NOT to observe. observe is for raw-metric queries; this tool is for the rollup. Gracefully degrades: layers in Kubernetes pod data and ML anomaly context when those backends are present, but still returns useful APM-only output if they aren't. Do not use for log-only or metrics-only customers — this tool requires Elastic APM.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2345,2348,2349,2350],{"name":2346,"slug":2347,"type":15},"APM","apm",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":2351,"slug":2352,"type":15},"Observability","observability","2026-07-12T07:49:24.405551",{"slug":2355,"name":2355,"fn":2356,"description":2357,"org":2358,"tags":2359,"stars":23,"repoUrl":24,"updatedAt":2364},"apm-service-dependencies","map application topology from APM telemetry","Map the application topology from APM telemetry — which services call which, over what protocols, with what call volume and latency. Use when the user asks \"what calls X\", \"what depends on X\", \"show me the topology\", \"what are the upstream\u002Fdownstream services\", \"where does this service fit\", or is doing root-cause investigation and needs to trace how a problem propagates through the call graph. Also trigger for \"service map\", \"dependency graph\", \"blast radius of service X\", or \"who's the dependency of Y\". Requires Elastic APM — do not trigger for log-only or metrics-only customers.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2360,2361,2362,2363],{"name":2346,"slug":2347,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":2351,"slug":2352,"type":15},"2026-07-12T07:49:23.167442",{"slug":2366,"name":2366,"fn":2367,"description":2368,"org":2369,"tags":2370,"stars":23,"repoUrl":24,"updatedAt":2379},"k8s-blast-radius","assess Kubernetes node failure impact","Assess the impact of a Kubernetes node going offline — which deployments lose all replicas (full outage), which lose partial capacity (degraded), which are unaffected, and whether the cluster has enough spare capacity to reschedule the lost pods. Use when the user asks \"what happens if node X goes down\", \"what's the blast radius of draining this node\", \"can I safely maintain node Y\", \"what's running on this node\", \"if I evict this node what breaks\", or is planning node maintenance, a cluster upgrade, or investigating an actual node failure. Requires Kubernetes (kubeletstats metrics) and Elastic APM for downstream service impact — do not trigger for non-K8s deployments.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2371,2372,2375,2376],{"name":9,"slug":8,"type":15},{"name":2373,"slug":2374,"type":15},"Kubernetes","kubernetes",{"name":2351,"slug":2352,"type":15},{"name":2377,"slug":2378,"type":15},"Risk Assessment","risk-assessment","2026-07-12T07:49:25.645103",{"slug":4,"name":4,"fn":5,"description":6,"org":2381,"tags":2382,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2383,2384,2385,2386],{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":17,"slug":18,"type":15},{"slug":2388,"name":2388,"fn":2389,"description":2390,"org":2391,"tags":2392,"stars":23,"repoUrl":24,"updatedAt":2401},"ml-anomalies","query Elastic ML anomaly detection results","Query Elastic ML anomaly detection results to understand what's behaving unusually, why, and how badly. Use when the user asks \"what's anomalous\", \"is anything unusual happening\", \"why is X slow\u002Fspiking\", \"show me the weirdness\", or mentions memory growth, CPU spikes, restart patterns, unusual latency, unexpected error rates, or drift from typical behavior. Also trigger for \"ML anomalies\", \"anomaly detection\", \"Elastic ML\", \"what does ML think\", or when the user wants to understand behavior that deviates from baseline. The tool opens an inline explainer view with a severity gauge, plain-English narrative, and per-entity deviation breakdown — so the agent should USE the visualization, not just dump JSON.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2393,2396,2397,2400],{"name":2394,"slug":2395,"type":15},"Anomaly Detection","anomaly-detection",{"name":9,"slug":8,"type":15},{"name":2398,"slug":2399,"type":15},"Machine Learning","machine-learning",{"name":2351,"slug":2352,"type":15},"2026-07-12T07:49:26.869446",{"slug":234,"name":234,"fn":2403,"description":2404,"org":2405,"tags":2406,"stars":23,"repoUrl":24,"updatedAt":2413},"monitor Elastic observability telemetry","The agent's Elastic-access primitive. Four modes: wait for an ML anomaly to fire, poll an ES|QL metric (live-sample or wait for a threshold), read a single-instance scalar value, or return a full ES|QL table. Use when the user says \"tell me when...\", \"let me know if...\", \"wait until X drops below Y\", \"watch for anything unusual\", \"monitor for the next N minutes\", \"poll until stable\", \"what is X right now\", \"list …\", \"which … are …\", or wants transient (session-scoped) monitoring or ad-hoc querying without creating a persistent Kibana rule. Also trigger for \"keep an eye on\" and post-remediation validation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2407,2408,2411,2412],{"name":9,"slug":8,"type":15},{"name":2409,"slug":2410,"type":15},"Metrics","metrics",{"name":17,"slug":18,"type":15},{"name":2351,"slug":2352,"type":15},"2026-07-12T07:49:28.114697"]