[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-observability-rca":3,"mdc--xh5uvh-key":33,"related-repo-elastic-observability-rca":604,"related-org-elastic-observability-rca":642},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":31,"mdContent":32},"observability-rca","perform root cause analysis on Elastic incidents","Use this skill when performing root cause analysis on incidents detected by Elastic Observability. Activate when the user reports a production issue, outage, degraded performance, or asks to investigate alerts.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Kibana","kibana",{"name":21,"slug":22,"type":15},"Debugging","debugging",16,"https:\u002F\u002Fgithub.com\u002Felastic\u002Felastic-ramen","2026-07-12T07:49:43.695963",null,4,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":26},[],"https:\u002F\u002Fgithub.com\u002Felastic\u002Felastic-ramen\u002Ftree\u002FHEAD\u002Fpackages\u002Fopencode\u002Fsrc\u002Felastic\u002Fskills\u002Fobservability-rca","---\nname: observability-rca\ndescription: >\n  Use this skill when performing root cause analysis on incidents detected\n  by Elastic Observability. Activate when the user reports a production issue,\n  outage, degraded performance, or asks to investigate alerts.\nmetadata:\n  version: 0.1.0\n  visibility: public\n---\n\n# Elastic Observability Root Cause Analysis\n\n## Investigation Framework\n\n### 1. Assess Scope\n\nStart with high-level health checks:\n\n```bash\nelastic es cluster health\nelastic slos list\n```\n\nCheck for widespread vs isolated issues by querying error rates across services:\n\n```bash\nelastic es query 'FROM logs-* | WHERE @timestamp > NOW() - 1 HOUR AND log.level == \"error\" | STATS errors = COUNT(*) BY service.name | SORT errors DESC | LIMIT 20'\n```\n\n### 2. Timeline Reconstruction\n\nEstablish when the issue started:\n\n```bash\nelastic es query 'FROM logs-* | WHERE service.name == \"\u003Caffected-service>\" AND log.level == \"error\" | STATS errors = COUNT(*) BY bucket = BUCKET(@timestamp, 1 minute) | SORT bucket | LIMIT 120'\n```\n\nLook for deployment or config changes around that time:\n\n```bash\nelastic es query 'FROM logs-* | WHERE @timestamp > NOW() - 4 HOURS AND (message LIKE \"*deploy*\" OR message LIKE \"*restart*\" OR message LIKE \"*config*\") | SORT @timestamp DESC | LIMIT 20'\n```\n\n### 3. Correlation Analysis\n\n**Cross-service dependencies:**\n```bash\nelastic es query 'FROM traces-* | WHERE @timestamp > NOW() - 1 HOUR AND service.name == \"\u003Cservice>\" | STATS avg_duration = AVG(transaction.duration.us), error_rate = COUNT_DISTINCT(CASE(event.outcome == \"failure\", trace.id)) BY service.target.name | SORT avg_duration DESC'\n```\n\n**Infrastructure metrics:**\n```bash\nelastic es query 'FROM metrics-system.cpu-* | WHERE @timestamp > NOW() - 2 HOURS | STATS cpu = AVG(system.cpu.total.norm.pct) BY host.name, bucket = BUCKET(@timestamp, 5 minute) | WHERE cpu > 0.8 | SORT bucket'\n```\n\n**Network connectivity:**\n```bash\nelastic es query 'FROM metrics-system.network-* | WHERE @timestamp > NOW() - 1 HOUR | STATS dropped = SUM(system.network.in.dropped), errors = SUM(system.network.in.errors) BY host.name | WHERE dropped > 0 OR errors > 0'\n```\n\n### 4. Common Root Causes\n\n| Symptom | Check | Likely Cause |\n|---------|-------|-------------|\n| High latency across services | CPU\u002Fmemory metrics | Resource exhaustion |\n| Intermittent 5xx errors | Dependency health | Downstream service failure |\n| Connection timeouts | Network metrics | Network partition or DNS issue |\n| Gradual degradation | Disk\u002Fmemory trends | Resource leak |\n| Sudden spike then recovery | Deploy logs | Bad deployment (auto-rolled-back) |\n\n### 5. Resolution Documentation\n\nAfter identifying root cause, document:\n- **What happened**: observable symptoms\n- **When**: timeline with key events\n- **Root cause**: the underlying issue\n- **Impact**: affected services, users, SLOs\n- **Remediation**: what was done to fix it\n- **Prevention**: how to prevent recurrence\n",{"data":34,"body":38},{"name":4,"description":6,"metadata":35},{"version":36,"visibility":37},"0.1.0","public",{"type":39,"children":40},"root",[41,50,57,64,70,127,132,171,177,182,217,222,257,263,272,307,315,350,358,393,399,522,528,533,598],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"elastic-observability-root-cause-analysis",[47],{"type":48,"value":49},"text","Elastic Observability Root Cause Analysis",{"type":42,"tag":51,"props":52,"children":54},"h2",{"id":53},"investigation-framework",[55],{"type":48,"value":56},"Investigation Framework",{"type":42,"tag":58,"props":59,"children":61},"h3",{"id":60},"_1-assess-scope",[62],{"type":48,"value":63},"1. Assess Scope",{"type":42,"tag":65,"props":66,"children":67},"p",{},[68],{"type":48,"value":69},"Start with high-level health checks:",{"type":42,"tag":71,"props":72,"children":77},"pre",{"className":73,"code":74,"language":75,"meta":76,"style":76},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","elastic es cluster health\nelastic slos list\n","bash","",[78],{"type":42,"tag":79,"props":80,"children":81},"code",{"__ignoreMap":76},[82,109],{"type":42,"tag":83,"props":84,"children":87},"span",{"class":85,"line":86},"line",1,[88,93,99,104],{"type":42,"tag":83,"props":89,"children":91},{"style":90},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[92],{"type":48,"value":8},{"type":42,"tag":83,"props":94,"children":96},{"style":95},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[97],{"type":48,"value":98}," es",{"type":42,"tag":83,"props":100,"children":101},{"style":95},[102],{"type":48,"value":103}," cluster",{"type":42,"tag":83,"props":105,"children":106},{"style":95},[107],{"type":48,"value":108}," health\n",{"type":42,"tag":83,"props":110,"children":112},{"class":85,"line":111},2,[113,117,122],{"type":42,"tag":83,"props":114,"children":115},{"style":90},[116],{"type":48,"value":8},{"type":42,"tag":83,"props":118,"children":119},{"style":95},[120],{"type":48,"value":121}," slos",{"type":42,"tag":83,"props":123,"children":124},{"style":95},[125],{"type":48,"value":126}," list\n",{"type":42,"tag":65,"props":128,"children":129},{},[130],{"type":48,"value":131},"Check for widespread vs isolated issues by querying error rates across services:",{"type":42,"tag":71,"props":133,"children":135},{"className":73,"code":134,"language":75,"meta":76,"style":76},"elastic es query 'FROM logs-* | WHERE @timestamp > NOW() - 1 HOUR AND log.level == \"error\" | STATS errors = COUNT(*) BY service.name | SORT errors DESC | LIMIT 20'\n",[136],{"type":42,"tag":79,"props":137,"children":138},{"__ignoreMap":76},[139],{"type":42,"tag":83,"props":140,"children":141},{"class":85,"line":86},[142,146,150,155,161,166],{"type":42,"tag":83,"props":143,"children":144},{"style":90},[145],{"type":48,"value":8},{"type":42,"tag":83,"props":147,"children":148},{"style":95},[149],{"type":48,"value":98},{"type":42,"tag":83,"props":151,"children":152},{"style":95},[153],{"type":48,"value":154}," query",{"type":42,"tag":83,"props":156,"children":158},{"style":157},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[159],{"type":48,"value":160}," '",{"type":42,"tag":83,"props":162,"children":163},{"style":95},[164],{"type":48,"value":165},"FROM logs-* | WHERE @timestamp > NOW() - 1 HOUR AND log.level == \"error\" | STATS errors = COUNT(*) BY service.name | SORT errors DESC | LIMIT 20",{"type":42,"tag":83,"props":167,"children":168},{"style":157},[169],{"type":48,"value":170},"'\n",{"type":42,"tag":58,"props":172,"children":174},{"id":173},"_2-timeline-reconstruction",[175],{"type":48,"value":176},"2. Timeline Reconstruction",{"type":42,"tag":65,"props":178,"children":179},{},[180],{"type":48,"value":181},"Establish when the issue started:",{"type":42,"tag":71,"props":183,"children":185},{"className":73,"code":184,"language":75,"meta":76,"style":76},"elastic es query 'FROM logs-* | WHERE service.name == \"\u003Caffected-service>\" AND log.level == \"error\" | STATS errors = COUNT(*) BY bucket = BUCKET(@timestamp, 1 minute) | SORT bucket | LIMIT 120'\n",[186],{"type":42,"tag":79,"props":187,"children":188},{"__ignoreMap":76},[189],{"type":42,"tag":83,"props":190,"children":191},{"class":85,"line":86},[192,196,200,204,208,213],{"type":42,"tag":83,"props":193,"children":194},{"style":90},[195],{"type":48,"value":8},{"type":42,"tag":83,"props":197,"children":198},{"style":95},[199],{"type":48,"value":98},{"type":42,"tag":83,"props":201,"children":202},{"style":95},[203],{"type":48,"value":154},{"type":42,"tag":83,"props":205,"children":206},{"style":157},[207],{"type":48,"value":160},{"type":42,"tag":83,"props":209,"children":210},{"style":95},[211],{"type":48,"value":212},"FROM logs-* | WHERE service.name == \"\u003Caffected-service>\" AND log.level == \"error\" | STATS errors = COUNT(*) BY bucket = BUCKET(@timestamp, 1 minute) | SORT bucket | LIMIT 120",{"type":42,"tag":83,"props":214,"children":215},{"style":157},[216],{"type":48,"value":170},{"type":42,"tag":65,"props":218,"children":219},{},[220],{"type":48,"value":221},"Look for deployment or config changes around that time:",{"type":42,"tag":71,"props":223,"children":225},{"className":73,"code":224,"language":75,"meta":76,"style":76},"elastic es query 'FROM logs-* | WHERE @timestamp > NOW() - 4 HOURS AND (message LIKE \"*deploy*\" OR message LIKE \"*restart*\" OR message LIKE \"*config*\") | SORT @timestamp DESC | LIMIT 20'\n",[226],{"type":42,"tag":79,"props":227,"children":228},{"__ignoreMap":76},[229],{"type":42,"tag":83,"props":230,"children":231},{"class":85,"line":86},[232,236,240,244,248,253],{"type":42,"tag":83,"props":233,"children":234},{"style":90},[235],{"type":48,"value":8},{"type":42,"tag":83,"props":237,"children":238},{"style":95},[239],{"type":48,"value":98},{"type":42,"tag":83,"props":241,"children":242},{"style":95},[243],{"type":48,"value":154},{"type":42,"tag":83,"props":245,"children":246},{"style":157},[247],{"type":48,"value":160},{"type":42,"tag":83,"props":249,"children":250},{"style":95},[251],{"type":48,"value":252},"FROM logs-* | WHERE @timestamp > NOW() - 4 HOURS AND (message LIKE \"*deploy*\" OR message LIKE \"*restart*\" OR message LIKE \"*config*\") | SORT @timestamp DESC | LIMIT 20",{"type":42,"tag":83,"props":254,"children":255},{"style":157},[256],{"type":48,"value":170},{"type":42,"tag":58,"props":258,"children":260},{"id":259},"_3-correlation-analysis",[261],{"type":48,"value":262},"3. Correlation Analysis",{"type":42,"tag":65,"props":264,"children":265},{},[266],{"type":42,"tag":267,"props":268,"children":269},"strong",{},[270],{"type":48,"value":271},"Cross-service dependencies:",{"type":42,"tag":71,"props":273,"children":275},{"className":73,"code":274,"language":75,"meta":76,"style":76},"elastic es query 'FROM traces-* | WHERE @timestamp > NOW() - 1 HOUR AND service.name == \"\u003Cservice>\" | STATS avg_duration = AVG(transaction.duration.us), error_rate = COUNT_DISTINCT(CASE(event.outcome == \"failure\", trace.id)) BY service.target.name | SORT avg_duration DESC'\n",[276],{"type":42,"tag":79,"props":277,"children":278},{"__ignoreMap":76},[279],{"type":42,"tag":83,"props":280,"children":281},{"class":85,"line":86},[282,286,290,294,298,303],{"type":42,"tag":83,"props":283,"children":284},{"style":90},[285],{"type":48,"value":8},{"type":42,"tag":83,"props":287,"children":288},{"style":95},[289],{"type":48,"value":98},{"type":42,"tag":83,"props":291,"children":292},{"style":95},[293],{"type":48,"value":154},{"type":42,"tag":83,"props":295,"children":296},{"style":157},[297],{"type":48,"value":160},{"type":42,"tag":83,"props":299,"children":300},{"style":95},[301],{"type":48,"value":302},"FROM traces-* | WHERE @timestamp > NOW() - 1 HOUR AND service.name == \"\u003Cservice>\" | STATS avg_duration = AVG(transaction.duration.us), error_rate = COUNT_DISTINCT(CASE(event.outcome == \"failure\", trace.id)) BY service.target.name | SORT avg_duration DESC",{"type":42,"tag":83,"props":304,"children":305},{"style":157},[306],{"type":48,"value":170},{"type":42,"tag":65,"props":308,"children":309},{},[310],{"type":42,"tag":267,"props":311,"children":312},{},[313],{"type":48,"value":314},"Infrastructure metrics:",{"type":42,"tag":71,"props":316,"children":318},{"className":73,"code":317,"language":75,"meta":76,"style":76},"elastic es query 'FROM metrics-system.cpu-* | WHERE @timestamp > NOW() - 2 HOURS | STATS cpu = AVG(system.cpu.total.norm.pct) BY host.name, bucket = BUCKET(@timestamp, 5 minute) | WHERE cpu > 0.8 | SORT bucket'\n",[319],{"type":42,"tag":79,"props":320,"children":321},{"__ignoreMap":76},[322],{"type":42,"tag":83,"props":323,"children":324},{"class":85,"line":86},[325,329,333,337,341,346],{"type":42,"tag":83,"props":326,"children":327},{"style":90},[328],{"type":48,"value":8},{"type":42,"tag":83,"props":330,"children":331},{"style":95},[332],{"type":48,"value":98},{"type":42,"tag":83,"props":334,"children":335},{"style":95},[336],{"type":48,"value":154},{"type":42,"tag":83,"props":338,"children":339},{"style":157},[340],{"type":48,"value":160},{"type":42,"tag":83,"props":342,"children":343},{"style":95},[344],{"type":48,"value":345},"FROM metrics-system.cpu-* | WHERE @timestamp > NOW() - 2 HOURS | STATS cpu = AVG(system.cpu.total.norm.pct) BY host.name, bucket = BUCKET(@timestamp, 5 minute) | WHERE cpu > 0.8 | SORT bucket",{"type":42,"tag":83,"props":347,"children":348},{"style":157},[349],{"type":48,"value":170},{"type":42,"tag":65,"props":351,"children":352},{},[353],{"type":42,"tag":267,"props":354,"children":355},{},[356],{"type":48,"value":357},"Network connectivity:",{"type":42,"tag":71,"props":359,"children":361},{"className":73,"code":360,"language":75,"meta":76,"style":76},"elastic es query 'FROM metrics-system.network-* | WHERE @timestamp > NOW() - 1 HOUR | STATS dropped = SUM(system.network.in.dropped), errors = SUM(system.network.in.errors) BY host.name | WHERE dropped > 0 OR errors > 0'\n",[362],{"type":42,"tag":79,"props":363,"children":364},{"__ignoreMap":76},[365],{"type":42,"tag":83,"props":366,"children":367},{"class":85,"line":86},[368,372,376,380,384,389],{"type":42,"tag":83,"props":369,"children":370},{"style":90},[371],{"type":48,"value":8},{"type":42,"tag":83,"props":373,"children":374},{"style":95},[375],{"type":48,"value":98},{"type":42,"tag":83,"props":377,"children":378},{"style":95},[379],{"type":48,"value":154},{"type":42,"tag":83,"props":381,"children":382},{"style":157},[383],{"type":48,"value":160},{"type":42,"tag":83,"props":385,"children":386},{"style":95},[387],{"type":48,"value":388},"FROM metrics-system.network-* | WHERE @timestamp > NOW() - 1 HOUR | STATS dropped = SUM(system.network.in.dropped), errors = SUM(system.network.in.errors) BY host.name | WHERE dropped > 0 OR errors > 0",{"type":42,"tag":83,"props":390,"children":391},{"style":157},[392],{"type":48,"value":170},{"type":42,"tag":58,"props":394,"children":396},{"id":395},"_4-common-root-causes",[397],{"type":48,"value":398},"4. Common Root Causes",{"type":42,"tag":400,"props":401,"children":402},"table",{},[403,427],{"type":42,"tag":404,"props":405,"children":406},"thead",{},[407],{"type":42,"tag":408,"props":409,"children":410},"tr",{},[411,417,422],{"type":42,"tag":412,"props":413,"children":414},"th",{},[415],{"type":48,"value":416},"Symptom",{"type":42,"tag":412,"props":418,"children":419},{},[420],{"type":48,"value":421},"Check",{"type":42,"tag":412,"props":423,"children":424},{},[425],{"type":48,"value":426},"Likely Cause",{"type":42,"tag":428,"props":429,"children":430},"tbody",{},[431,450,468,486,504],{"type":42,"tag":408,"props":432,"children":433},{},[434,440,445],{"type":42,"tag":435,"props":436,"children":437},"td",{},[438],{"type":48,"value":439},"High latency across services",{"type":42,"tag":435,"props":441,"children":442},{},[443],{"type":48,"value":444},"CPU\u002Fmemory metrics",{"type":42,"tag":435,"props":446,"children":447},{},[448],{"type":48,"value":449},"Resource exhaustion",{"type":42,"tag":408,"props":451,"children":452},{},[453,458,463],{"type":42,"tag":435,"props":454,"children":455},{},[456],{"type":48,"value":457},"Intermittent 5xx errors",{"type":42,"tag":435,"props":459,"children":460},{},[461],{"type":48,"value":462},"Dependency health",{"type":42,"tag":435,"props":464,"children":465},{},[466],{"type":48,"value":467},"Downstream service failure",{"type":42,"tag":408,"props":469,"children":470},{},[471,476,481],{"type":42,"tag":435,"props":472,"children":473},{},[474],{"type":48,"value":475},"Connection timeouts",{"type":42,"tag":435,"props":477,"children":478},{},[479],{"type":48,"value":480},"Network metrics",{"type":42,"tag":435,"props":482,"children":483},{},[484],{"type":48,"value":485},"Network partition or DNS issue",{"type":42,"tag":408,"props":487,"children":488},{},[489,494,499],{"type":42,"tag":435,"props":490,"children":491},{},[492],{"type":48,"value":493},"Gradual degradation",{"type":42,"tag":435,"props":495,"children":496},{},[497],{"type":48,"value":498},"Disk\u002Fmemory trends",{"type":42,"tag":435,"props":500,"children":501},{},[502],{"type":48,"value":503},"Resource leak",{"type":42,"tag":408,"props":505,"children":506},{},[507,512,517],{"type":42,"tag":435,"props":508,"children":509},{},[510],{"type":48,"value":511},"Sudden spike then recovery",{"type":42,"tag":435,"props":513,"children":514},{},[515],{"type":48,"value":516},"Deploy logs",{"type":42,"tag":435,"props":518,"children":519},{},[520],{"type":48,"value":521},"Bad deployment (auto-rolled-back)",{"type":42,"tag":58,"props":523,"children":525},{"id":524},"_5-resolution-documentation",[526],{"type":48,"value":527},"5. Resolution Documentation",{"type":42,"tag":65,"props":529,"children":530},{},[531],{"type":48,"value":532},"After identifying root cause, document:",{"type":42,"tag":534,"props":535,"children":536},"ul",{},[537,548,558,568,578,588],{"type":42,"tag":538,"props":539,"children":540},"li",{},[541,546],{"type":42,"tag":267,"props":542,"children":543},{},[544],{"type":48,"value":545},"What happened",{"type":48,"value":547},": observable symptoms",{"type":42,"tag":538,"props":549,"children":550},{},[551,556],{"type":42,"tag":267,"props":552,"children":553},{},[554],{"type":48,"value":555},"When",{"type":48,"value":557},": timeline with key events",{"type":42,"tag":538,"props":559,"children":560},{},[561,566],{"type":42,"tag":267,"props":562,"children":563},{},[564],{"type":48,"value":565},"Root cause",{"type":48,"value":567},": the underlying issue",{"type":42,"tag":538,"props":569,"children":570},{},[571,576],{"type":42,"tag":267,"props":572,"children":573},{},[574],{"type":48,"value":575},"Impact",{"type":48,"value":577},": affected services, users, SLOs",{"type":42,"tag":538,"props":579,"children":580},{},[581,586],{"type":42,"tag":267,"props":582,"children":583},{},[584],{"type":48,"value":585},"Remediation",{"type":48,"value":587},": what was done to fix it",{"type":42,"tag":538,"props":589,"children":590},{},[591,596],{"type":42,"tag":267,"props":592,"children":593},{},[594],{"type":48,"value":595},"Prevention",{"type":48,"value":597},": how to prevent recurrence",{"type":42,"tag":599,"props":600,"children":601},"style",{},[602],{"type":48,"value":603},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":605,"total":641},[606,622,629],{"slug":607,"name":607,"fn":608,"description":609,"org":610,"tags":611,"stars":23,"repoUrl":24,"updatedAt":621},"elastic-cli-usage","execute Elasticsearch CLI commands","Guides execution of elasticsearch CLI commands via elastic_cli, resolves serverless-specific errors, and routes tasks between CLI and MCP\u002FKibana API tools. Use when running es or kb commands, debugging elastic CLI argument syntax, hitting 410 serverless errors, or deciding whether to use elastic_cli vs native Kibana tools.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[612,615,616,617,620],{"name":613,"slug":614,"type":15},"CLI","cli",{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"name":618,"slug":619,"type":15},"Elasticsearch","elasticsearch",{"name":18,"slug":19,"type":15},"2026-07-12T07:49:44.954024",{"slug":4,"name":4,"fn":5,"description":6,"org":623,"tags":624,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[625,626,627,628],{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},{"name":13,"slug":14,"type":15},{"slug":630,"name":630,"fn":631,"description":632,"org":633,"tags":634,"stars":23,"repoUrl":24,"updatedAt":640},"slo-management","manage Elastic Service Level Objectives","Use this skill when working with Elastic SLOs (Service Level Objectives). Activate when the user asks about SLO status, burn rates, error budgets, or needs to create and manage SLO definitions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[635,636,639],{"name":9,"slug":8,"type":15},{"name":637,"slug":638,"type":15},"Monitoring","monitoring",{"name":13,"slug":14,"type":15},"2026-07-12T07:49:41.13997",3,{"items":643,"total":811},[644,663,678,691,710,722,732,747,759,774,785,798],{"slug":645,"name":645,"fn":646,"description":647,"org":648,"tags":649,"stars":660,"repoUrl":661,"updatedAt":662},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[650,653,656,657],{"name":651,"slug":652,"type":15},"Analytics","analytics",{"name":654,"slug":655,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":658,"slug":659,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":664,"name":664,"fn":665,"description":666,"org":667,"tags":668,"stars":660,"repoUrl":661,"updatedAt":677},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[669,670,671,674],{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"name":672,"slug":673,"type":15},"Engineering","engineering",{"name":675,"slug":676,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":679,"name":679,"fn":680,"description":681,"org":682,"tags":683,"stars":660,"repoUrl":661,"updatedAt":690},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[684,685,686,687],{"name":9,"slug":8,"type":15},{"name":618,"slug":619,"type":15},{"name":658,"slug":659,"type":15},{"name":688,"slug":689,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":692,"name":692,"fn":693,"description":694,"org":695,"tags":696,"stars":707,"repoUrl":708,"updatedAt":709},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[697,700,701,704],{"name":698,"slug":699,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":702,"slug":703,"type":15},"Operations","operations",{"name":705,"slug":706,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":711,"name":711,"fn":712,"description":713,"org":714,"tags":715,"stars":707,"repoUrl":708,"updatedAt":721},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[716,717,720],{"name":698,"slug":699,"type":15},{"name":718,"slug":719,"type":15},"Deployment","deployment",{"name":618,"slug":619,"type":15},"2026-07-12T07:46:42.353362",{"slug":723,"name":723,"fn":724,"description":725,"org":726,"tags":727,"stars":707,"repoUrl":708,"updatedAt":731},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[728,729,730],{"name":698,"slug":699,"type":15},{"name":618,"slug":619,"type":15},{"name":702,"slug":703,"type":15},"2026-07-12T07:46:41.097412",{"slug":733,"name":733,"fn":734,"description":735,"org":736,"tags":737,"stars":707,"repoUrl":708,"updatedAt":746},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[738,739,740,743],{"name":698,"slug":699,"type":15},{"name":618,"slug":619,"type":15},{"name":741,"slug":742,"type":15},"Networking","networking",{"name":744,"slug":745,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":748,"name":748,"fn":749,"description":750,"org":751,"tags":752,"stars":707,"repoUrl":708,"updatedAt":758},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[753,756,757],{"name":754,"slug":755,"type":15},"Authentication","authentication",{"name":698,"slug":699,"type":15},{"name":618,"slug":619,"type":15},"2026-07-12T07:46:39.783105",{"slug":760,"name":760,"fn":761,"description":762,"org":763,"tags":764,"stars":707,"repoUrl":708,"updatedAt":773},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[765,768,769,772],{"name":766,"slug":767,"type":15},"Audit","audit",{"name":618,"slug":619,"type":15},{"name":770,"slug":771,"type":15},"Logs","logs",{"name":744,"slug":745,"type":15},"2026-07-12T07:47:35.092599",{"slug":775,"name":775,"fn":776,"description":777,"org":778,"tags":779,"stars":707,"repoUrl":708,"updatedAt":784},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[780,781,782,783],{"name":754,"slug":755,"type":15},{"name":9,"slug":8,"type":15},{"name":618,"slug":619,"type":15},{"name":744,"slug":745,"type":15},"2026-07-12T07:47:41.474547",{"slug":786,"name":786,"fn":787,"description":788,"org":789,"tags":790,"stars":707,"repoUrl":708,"updatedAt":797},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[791,792,793,796],{"name":9,"slug":8,"type":15},{"name":618,"slug":619,"type":15},{"name":794,"slug":795,"type":15},"RBAC","rbac",{"name":744,"slug":745,"type":15},"2026-07-12T07:47:36.394177",{"slug":799,"name":799,"fn":800,"description":801,"org":802,"tags":803,"stars":707,"repoUrl":708,"updatedAt":810},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[804,805,806,807],{"name":651,"slug":652,"type":15},{"name":654,"slug":655,"type":15},{"name":618,"slug":619,"type":15},{"name":808,"slug":809,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]