[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-observe":3,"mdc--6u15ig-key":33,"related-repo-elastic-observe":6005,"related-org-elastic-observe":6078},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":31,"mdContent":32},"observe","monitor Elastic observability telemetry","The agent's Elastic-access primitive. Four modes: wait for an ML anomaly to fire, poll an ES|QL metric (live-sample or wait for a threshold), read a single-instance scalar value, or return a full ES|QL table. Use when the user says \"tell me when...\", \"let me know if...\", \"wait until X drops below Y\", \"watch for anything unusual\", \"monitor for the next N minutes\", \"poll until stable\", \"what is X right now\", \"list …\", \"which … are …\", or wants transient (session-scoped) monitoring or ad-hoc querying without creating a persistent Kibana rule. Also trigger for \"keep an eye on\" and post-remediation validation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":17,"slug":18,"type":15},"Monitoring","monitoring",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Metrics","metrics",10,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-observability","2026-07-12T07:49:28.114697",null,7,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":26},[],"https:\u002F\u002Fgithub.com\u002Felastic\u002Fexample-mcp-app-observability\u002Ftree\u002FHEAD\u002Fskills\u002Fobserve","---\nname: observe\ndescription: >\n The agent's Elastic-access primitive. Four modes: wait for an ML anomaly to fire, poll an ES|QL\n metric (live-sample or wait for a threshold), read a single-instance scalar value, or return a\n full ES|QL table. Use when the user says \"tell me when...\", \"let me know if...\", \"wait until X\n drops below Y\", \"watch for anything unusual\", \"monitor for the next N minutes\", \"poll until\n stable\", \"what is X right now\", \"list …\", \"which … are …\", or wants transient (session-scoped)\n monitoring or ad-hoc querying without creating a persistent Kibana rule. Also trigger for \"keep\n an eye on\" and post-remediation validation.\n---\n\n# Observe\n\nTransient, session-scoped monitoring and ad-hoc querying. Unlike `manage-alerts` (which\ncreates a durable saved object in Kibana), `observe` polls in-process and returns once fired,\nonce its window closes, or — in `now` \u002F `table` mode — immediately.\n\n## Modes\n\n### Decision tree — pick based on tense FIRST, then on shape\n\n```\nDoes the user phrase it as past or future?\n\nPAST tense \u002F windowed lookback FUTURE tense \u002F live monitoring\n(\"what WAS \u002F over the past N \u002F (\"watch \u002F monitor \u002F wait until \u002F\n in the last N \u002F how did X look\") live-sample \u002F for the NEXT N\")\n │ │\n ▼ ▼\nIs it a single number or a series? Is there a threshold to fire on?\n │ │\n ┌───┴────┐ ┌──┴──┐\nsingle series yes no\n │ │ │ │\n ▼ ▼ ▼ ▼\n now table metric metric\n (with (live-\n condition) sample)\n\nOther:\n • \"tell me when anything unusual fires\" → anomaly (default)\n • \"list X \u002F which X are Y \u002F top N\" (any tense) → table\n • \"page me whenever...\" → use manage-alerts instead\n```\n\n| Mode | When to pick it | Blocks? |\n|------|-----------------|---------|\n| `now` | **Past-tense windowed scalar.** \"What was X right now \u002F over the past 60 seconds \u002F in the last 15 minutes \u002F average X for the last hour\". Put the window inside the ES\\|QL via `WHERE @timestamp > NOW() - \u003Cwindow>`. Single number out. | Returns immediately |\n| `table` | **Past-tense time series OR group-by.** \"How did X look over the past hour\" (with `BUCKET()` for the chart), \"list X\", \"which X are Y\", any group-by \u002F top-N. The view auto-charts 2-column time-series tables. | Returns immediately |\n| `metric` | **Forward-looking only.** \"Watch X\", \"wait until X drops\", \"live-sample X for the next 60s\", \"wake me when X exceeds Y\". Polls live for `max_wait` seconds. **Never use this for past-tense \u002F \"what was X\" queries** — it will block for `max_wait` seconds before returning a value, which is the opposite of what the user asked. | Polls for `max_wait` seconds (default 60s) |\n| `anomaly` (default) | \"Tell me when anything unusual fires\", open-ended monitoring | Until an anomaly fires or `max_wait` elapses |\n\n> ⚠️ **Most common mistake: picking `metric` for a past-tense query.** A prompt like \"what was the frontend memory over the past 60 seconds?\" is asking about data that already exists — it's a windowed lookup, not a request to wait 60 more seconds and watch. Always inspect the verb before choosing `metric`:\n>\n> - **was \u002F were \u002F averaged \u002F hit \u002F spiked \u002F over the past \u002F in the last \u002F for the last** → `now` or `table`. NEVER `metric`.\n> - **watch \u002F monitor \u002F poll \u002F wait until \u002F wake me \u002F for the next \u002F until X happens \u002F live-sample** → `metric`.\n>\n> If the user wants durable alerting (\"page me whenever...\"), use `manage-alerts` instead.\n>\n> ⚠️ **Don't use observe for health rollups.** \"Show me the health of X\", \"status of the X\n> environment\", \"how is X doing\" — even with a time qualifier like \"over the past hour\" — should\n> route to `apm-health-summary`, not observe. observe is for raw-metric \u002F single-query investigations;\n> apm-health-summary returns the full rollup (degraded services, anomalies, pod resources). Pick\n> apm-health-summary whenever the user is asking a HEALTH question rather than a specific metric\n> question.\n\n## Prerequisites\n\n| Mode | Requires |\n|------|----------|\n| `anomaly` | Elastic ML anomaly detection jobs |\n| `metric` | Any ES\\|QL-queryable numeric field |\n| `now` | Any ES\\|QL-queryable numeric field |\n| `table` | Any ES\\|QL-queryable data |\n\n## How to call observe\n\n### Anomaly mode (default)\n\n```json\n{\n \"mode\": \"anomaly\",\n \"min_score\": 75,\n \"max_wait\": 600,\n \"namespace\": \"otel-demo\"\n}\n```\n\n- `min_score`: 75 default (major+), 50 for minor inclusion, 90 for critical-only.\n- `max_wait`: generous (600s default). Returns immediately on trigger — long waits are free.\n- `namespace`: only if the user scopes to a K8s namespace.\n\n### Metric mode — threshold condition\n\n```json\n{\n \"mode\": \"metric\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.pod.name == \\\"frontend-7d4b8f9c5-x2k9m\\\" | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"condition\": \"\u003C 80000000\",\n \"description\": \"frontend pod memory working set\",\n \"max_wait\": 300\n}\n```\n\nCondition format: `\u003Ccomparator> \u003Cthreshold>` — valid comparators: `\u003C`, `\u003C=`, `>`, `>=`, `==`.\n\n### Metric mode — live sample (no threshold)\n\nOmit `condition` and the tool live-samples for the full `max_wait` window — use for\n\"show me a live chart of X\" prompts. The view renders an accumulating sparkline.\n\n```json\n{\n \"mode\": \"metric\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.namespace.name == \\\"oteldemo-esyox-default\\\" | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"description\": \"oteldemo-esyox-default avg pod memory\",\n \"max_wait\": 60\n}\n```\n\n### Now mode — single read\n\n```json\n{\n \"mode\": \"now\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.namespace.name == \\\"oteldemo-esyox-default\\\" | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"description\": \"current avg pod memory in oteldemo-esyox-default\"\n}\n```\n\n**Past-tense windowed read** — when the user asks \"what was X over the past N seconds\u002Fminutes\u002Fhours\", put the window in the ES\\|QL `WHERE` clause, not in `max_wait`. The tool returns immediately with the aggregate; nothing is polled.\n\n```json\n{\n \"mode\": \"now\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.pod.name == \\\"frontend-7d4b8f9c5-x2k9m\\\" AND @timestamp > NOW() - 60 seconds | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"description\": \"frontend memory, last 60 seconds (avg)\"\n}\n```\n\nIf the user wants the time series (not just one number), use `table` mode with `BUCKET()` instead — that returns rows the view can chart.\n\n### Table mode — full ES|QL rows and columns\n\nUse when the query groups, lists, or returns mixed-type rows (strings + numbers + dates). `now` mode\ndiscards everything except the first numeric cell — `table` mode preserves the whole result.\n\n```json\n{\n \"mode\": \"table\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE metrics.k8s.pod.memory.working_set IS NOT NULL | STATS avg_mem = AVG(metrics.k8s.pod.memory.working_set) BY resource.attributes.k8s.pod.name, resource.attributes.k8s.namespace.name | SORT avg_mem DESC | LIMIT 10\",\n \"description\": \"top 10 pods by memory\"\n}\n```\n\n**Past-tense time series** — use `table` with `BUCKET()` to return one row per time slice the view can chart:\n\n```json\n{\n \"mode\": \"table\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.pod.name == \\\"frontend-7d4b8f9c5-x2k9m\\\" AND @timestamp > NOW() - 60 seconds | STATS v = AVG(metrics.k8s.pod.memory.working_set) BY bucket = BUCKET(@timestamp, 5 second) | SORT bucket ASC\",\n \"description\": \"frontend memory · 60s · 5s buckets\"\n}\n```\n\nRows are capped at 50 by default. Prefer tightening the ES|QL with `LIMIT` \u002F `SORT` over raising\n`row_cap` — very wide tables clog the context window.\n\n## Picking the right index pattern\n\nFields live where the data is emitted — ES|QL rejects queries that reference a field the\ntarget index doesn't map (`verification_exception`). Before writing the query, match the\nuser's question to the right layer:\n\n| User asks about… | Index | Carries |\n|---|---|---|\n| Node \u002F pod \u002F namespace topology, resource usage | `metrics-kubeletstatsreceiver.otel*` or `metrics-*` | `k8s.node.name`, `k8s.pod.name`, `k8s.namespace.name`, `service.name` (via resource attrs), CPU\u002Fmemory\u002Ffs gauges |\n| Service behavior — latency, errors, throughput, spans | `traces-*.otel-*` or `traces-apm*` | `service.name`, `transaction.duration.us`, `event.outcome`, `span.*` |\n| Log rate \u002F log content | `logs-*` | `message`, `log.level`, `service.name` |\n| ML anomalies | `.ml-anomalies-*` | `record_score`, `by_field_value`, `partition_field_value` |\n\nCross-layer questions (\"which **node** runs the most **services**\") need the index that\ncarries **both** fields — that's almost always `metrics-*`, because OTel resource\nattributes propagate through the Collector, so metrics docs carry `k8s.node.name` *and*\n`service.name`. Trace indices (`traces-apm*`, `traces-*.otel-*`) don't carry infra\nattributes like `k8s.node.name` — don't reach for them when the question is about nodes.\n\nExample: \"which node is running the most services\"\n\n```\nFROM metrics-*\n| WHERE @timestamp > NOW() - 5m AND k8s.node.name IS NOT NULL AND service.name IS NOT NULL\n| STATS service_count = COUNT_DISTINCT(service.name) BY k8s.node.name\n| SORT service_count DESC\n| LIMIT 20\n```\n\n## Common query patterns\n\nThese are the field paths this deployment's data actually uses — prefer them over guessing.\n\n> ⛔ **BEFORE WRITING ANY QUERY — check the field type first:**\n>\n> Look up the field you intend to aggregate in the tables below. If its type is `counter_long`, **stop — do not write `FROM`**. Use `TS` + `RATE()` as described in the \"Counter fields\" section. This is a hard syntax requirement: `FROM` is rejected for `counter_long` fields regardless of which aggregation function you use, and the error cannot be fixed by changing `AVG` to `MAX` or `SUM`. The source command must be `TS`.\n\n### OTel Kubernetes (kubeletstats receiver)\n\nIndex: `metrics-kubeletstatsreceiver.otel*`\n\nEach kubeletstats scrape emits **separate documents per metric** — a CPU doc, a memory doc, a network doc, etc. Always filter `WHERE \u003Cfield> IS NOT NULL` for the field you're aggregating, otherwise most rows carry nulls for it.\n\n**Gauge fields — use `AVG` \u002F `MAX` \u002F `MIN`, never `SUM`:**\n\n| Signal | Field | Type |\n|--------|-------|------|\n| Pod memory working set | `k8s.pod.memory.working_set` | `long` (bytes) |\n| Pod memory RSS | `k8s.pod.memory.rss` | `long` (bytes) |\n| Pod memory available | `k8s.pod.memory.available` | `long` (bytes) |\n| Pod CPU usage | `k8s.pod.cpu.usage` | `double` (cores — 1.0 = one full core) |\n| Pod filesystem usage | `k8s.pod.filesystem.usage` | `long` (bytes) |\n| Node memory working set | `k8s.node.memory.working_set` | `long` (bytes) |\n| Node memory available | `k8s.node.memory.available` | `long` (bytes) |\n| Node CPU usage | `k8s.node.cpu.usage` | `double` (cores) |\n| Node filesystem usage | `k8s.node.filesystem.usage` | `long` (bytes) |\n\n> For **counter** fields (network I\u002FO, network errors, uptime), see the \"Counter fields\" section below — these require `TS` + `RATE()`.\n\n**Fields that may NOT exist in every cluster's kubeletstats schema** — depends on whether the OTel collector \u002F kubelet is configured to scrape pod-spec data:\n\n| Field | When it's missing | What to do |\n|---|---|---|\n| `metrics.k8s.pod.cpu.limit` | Pods don't declare CPU limits, OR the collector isn't scraping pod-spec | Don't reference it — use raw `metrics.k8s.pod.cpu.usage` and report cores instead of % utilization |\n| `metrics.k8s.pod.memory.limit` | Same as above for memory | Same — report bytes instead of % |\n| `metrics.k8s.container.restart_count` | Collector isn't scraping pod-status (this is COMMON) | Don't reference it. Use APM error rates or alert reasons as a proxy for \"things crashing.\" There is no canonical alternative field name (`k8s.pod.restarts` is wrong — don't try it) |\n\n**Schema-aware error recovery.** When ESQL returns `Unknown column [X], did you mean [Y, Z]?`, read the suggestion and retry with one of `Y` or `Z` — don't blindly retry the same query or guess a different name from memory.\n\n**Dimension fields — use for filtering and `BY` grouping:**\n\n| Dimension | Unprefixed | Prefixed (equivalent) |\n|---|---|---|\n| Pod name | `k8s.pod.name` | `resource.attributes.k8s.pod.name` |\n| Namespace | `k8s.namespace.name` | `resource.attributes.k8s.namespace.name` |\n| Node name | `k8s.node.name` | `resource.attributes.k8s.node.name` |\n| Cluster name | `k8s.cluster.name` | (same) |\n\nBoth forms work on `metrics-kubeletstatsreceiver.otel*`. Prefer the unprefixed form — it's shorter and also works on counter-field queries via `TS`.\n\n**Common recipes:**\n\nTop pods by memory (last 5m, across all namespaces):\n\n```\nFROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes AND k8s.pod.memory.working_set IS NOT NULL\n| STATS avg_mem = AVG(k8s.pod.memory.working_set),\n max_mem = MAX(k8s.pod.memory.working_set)\n BY k8s.pod.name, k8s.namespace.name\n| SORT max_mem DESC\n| LIMIT 20\n```\n\nWhich pods are on a specific node:\n\n```\nFROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes\n AND k8s.node.name == \"\u003Cnode>\" AND k8s.pod.name IS NOT NULL\n| STATS last_seen = MAX(@timestamp) BY k8s.pod.name, k8s.namespace.name\n| SORT last_seen DESC\n```\n\nNamespace-wide memory average (single scalar — works in `now`\u002F`metric` mode):\n\n```\nFROM metrics-kubeletstatsreceiver.otel*\n| WHERE k8s.namespace.name == \"oteldemo-esyox-default\"\n AND k8s.pod.memory.working_set IS NOT NULL\n| STATS v = AVG(k8s.pod.memory.working_set)\n```\n\nIs this node under memory pressure (working-set vs available):\n\n```\nFROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes\n AND k8s.node.name == \"\u003Cnode>\" AND k8s.node.memory.working_set IS NOT NULL\n| STATS working_set = AVG(k8s.node.memory.working_set),\n available = AVG(k8s.node.memory.available)\n```\n\nPods above namespace memory average (requires ES 9.2+ `INLINE STATS`):\n\n```\nFROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes\n AND k8s.pod.memory.working_set IS NOT NULL\n AND k8s.namespace.name == \"\u003Cnamespace>\"\n| STATS pod_mem = AVG(k8s.pod.memory.working_set) BY k8s.pod.name\n| INLINE STATS ns_avg = AVG(pod_mem)\n| WHERE pod_mem > ns_avg\n| EVAL pct_above_avg = ROUND((pod_mem - ns_avg) * 100.0 \u002F ns_avg, 1)\n| SORT pod_mem DESC\n```\n\nUse `INLINE STATS` whenever the question involves comparing individual entities to a group aggregate\n(\"above average\", \"top X% of namespace memory\", \"pods consuming more than their share\"). Without it,\nthis requires two separate queries and client-side joining.\n\n### Counter fields — require `TS` + `RATE()`\n\n> ⛔ **MANDATORY PRE-QUERY CHECKLIST — run this before writing any ES|QL:**\n>\n> 1. **Is any field I'm querying in the counter fields table below?** (network I\u002FO, network errors, uptime)\n> - YES → **Stop. Use `TS`, not `FROM`.** Do not write `FROM` under any circumstances. Go to the `TS` pattern below.\n> - NO → `FROM` is fine. Proceed normally.\n> 2. **Am I inside a `TS` query?**\n> - Use `TBUCKET(duration)` for time bucketing — e.g. `TBUCKET(1 hour)`.\n> - **Never use `BUCKET(@timestamp, interval)`** — that is `FROM`-query syntax and will fail with a parse error inside `TS`.\n> 3. **Am I aggregating across multiple pods\u002Fnodes?**\n> - YES → wrap `RATE()` in `SUM()`.\n> - NO (single entity) → wrap in `AVG()`.\n>\n> Skipping this checklist and defaulting to `FROM` on a counter field is the single most common query mistake. The error it produces (`argument of [...] must be [...numeric except counter types]`) is not recoverable by changing the aggregation function — the source command must be `TS`.\n\nNetwork I\u002FO, network errors, and uptime fields are stored as monotonically-increasing counters\n(`counter_long`), **not** instantaneous gauges. `FROM` + `MAX`\u002F`AVG`\u002F`SUM`\u002F`VALUES` on a counter\nfield is a hard error — ES|QL returns `argument of [...] must be [...numeric except counter types]`.\n\n> **Version requirement:** `TS`, `RATE()`, and `TBUCKET()` require Elasticsearch **9.2+**. On older\n> clusters, `counter_long` fields cannot be aggregated at all — there is no workaround. If `TS \u003Cindex>`\n> returns a parse error, verify the cluster version before iterating on syntax.\n\nCounter fields in this deployment:\n\n| Field | Notes |\n|---|---|\n| `k8s.pod.network.io` | bytes, carries `direction` attribute (`transmit` \u002F `receive`) — emitted as separate docs per direction |\n| `k8s.pod.network.errors` | error count, also carries `direction` |\n| `k8s.node.network.io`, `k8s.node.network.errors` | node-level equivalents |\n| `k8s.node.uptime`, `k8s.pod.uptime` | seconds since start |\n\n**Correct pattern:** `TS` as the **source command** (replaces `FROM`), `RATE()` wrapped in an outer\naggregation, counter field filtered `IS NOT NULL`, and `BY direction` whenever querying network fields.\n\n```\n\u002F\u002F CORRECT — TS as source, SUM(RATE()) for cluster-wide total, BUCKET(@timestamp, interval) for time bucketing\n\u002F\u002F Always alias the BUCKET expression and SORT by the alias — SORT on the raw BUCKET(...) expression fails\nTS metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 15 minutes\n AND k8s.node.network.io IS NOT NULL\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY bucket = BUCKET(@timestamp, 1 minute), direction\n| SORT bucket ASC\n\n\u002F\u002F WRONG — FROM is rejected for counter_long fields\nFROM metrics-kubeletstatsreceiver.otel*\n| STATS max_io = MAX(k8s.node.network.io) ... ← hard error\n\n\u002F\u002F WRONG — sorting on the raw BUCKET expression (not the alias) fails in TS context\nTS metrics-kubeletstatsreceiver.otel*\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY bucket = BUCKET(@timestamp, 1 minute), direction\n| SORT BUCKET(@timestamp, 1 minute) ASC ← parse error; use alias instead\n```\n\n**`SUM` vs `AVG` when wrapping `RATE()`:** Use `SUM(RATE(...))` when aggregating across multiple\nparallel time series (e.g. total cluster throughput across all nodes). Use `AVG(RATE(...))` when you\nwant the mean rate per entity (e.g. average per-pod transmit rate). Mixing them up produces silently\nwrong numbers — `AVG` of a cluster-wide roll-up understates throughput; `SUM` of a single-entity\nquery overstates it.\n\n**Time bucketing in `TS` queries:** Use `BUCKET(@timestamp, interval)` — the same syntax as `FROM`\nqueries. Always assign it an alias (e.g. `BY bucket = BUCKET(@timestamp, 1 hour)`) and reference\nthat alias in any subsequent `SORT` — sorting on the raw `BUCKET(@timestamp, ...)` expression is\nrejected in `TS` context. `TBUCKET` (duration-only form) does **not** work reliably on this\ndeployment and should not be used.\n\n```\n\u002F\u002F CORRECT — aliased BUCKET, sorted by alias\nTS metrics-kubeletstatsreceiver.otel*\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY bucket = BUCKET(@timestamp, 1 hour), direction\n| SORT bucket ASC\n\n\u002F\u002F WRONG — TBUCKET is unreliable; fails with \"@timestamp not found\" on this deployment\nTS metrics-kubeletstatsreceiver.otel*\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY TBUCKET(1 hour), direction ← verification_exception on @timestamp\n\n\u002F\u002F WRONG — passing @timestamp to TBUCKET is also rejected\n| STATS ... BY TBUCKET(@timestamp, 1 hour) ← argument type error\n```\n\nRules:\n- `TS \u003Cindex>`, not `FROM \u003Cindex>`. `FROM` will be rejected for `counter_long` fields.\n- Wrap `RATE()` in `SUM()` for totals across entities, `AVG()` for per-entity averages — bare `RATE(...) BY ...` is rejected.\n- Network counters are emitted as **separate docs per direction**. Without `BY direction` or a `direction == \"...\"` filter, transmit and receive aggregate into a meaningless combined number.\n- Without `IS NOT NULL` the query spans many kubeletstats docs that carry a different metric — you get nulls, not errors.\n- Use `BUCKET(@timestamp, interval)` for time bucketing inside `TS` queries, always aliased. Do **not** use `TBUCKET`.\n\n**Escape hatch — raw counter snapshot:** if you want the current counter value (e.g. \"how long has\nnode X been up\"), cast first. `TO_LONG` strips the counter type and unlocks standard aggregations:\n\n```\nFROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes AND k8s.node.uptime IS NOT NULL\n| EVAL u = TO_LONG(k8s.node.uptime)\n| STATS uptime_s = MAX(u) BY k8s.node.name\n```\n\n### APM traces\n\nPrimary index: `traces-*.otel-*` (OTel-native). Fallback: `traces-apm*` (classic APM — only if the OTel path returns empty).\n\nIn EDOT-ingested clusters, `traces-*.otel-*` carries **both** OTel-native fields (`duration`, `kind`, `status.code`) and classic-APM-compatible fields (`processor.event`, `event.outcome`, `transaction.duration.us` on transaction-level docs). The cluster's \"APM-ness\" isn't determined by the index — it's determined by which field shape you query.\n\n| Signal | OTel-native (preferred) | Classic APM |\n|---|---|---|\n| Duration | `duration` (nanoseconds, long, populated on every span) | `transaction.duration.us` (microseconds, populated only on `processor.event == \"transaction\"` docs) |\n| Error signal | `event.outcome == \"failure\"` — **use this**, 100% populated | `status.code == \"Error\"` (sparse; only set when instrumentation explicitly calls `SetStatus`) |\n| Error message \u002F type \u002F stacktrace | `exception.message`, `exception.type`, `exception.stacktrace` | `error.message`, `error.exception.type`, `error.stack_trace` |\n| Span kind | `kind` — values `Server`, `Internal`, `Client`, `Producer`, `Consumer` (**title case**, not `SERVER`\u002F`CLIENT`) | `transaction.type` |\n| Scope filter | `kind == \"Server\"` isolates incoming requests | `processor.event == \"transaction\"` |\n| Service name | `service.name` | `service.name` |\n\n> **Unit warning.** OTel `duration` is in **nanoseconds**. Divide by 1,000,000 for milliseconds. Classic `transaction.duration.us` is in **microseconds** — divide by 1,000. Mixing these across a comparison produces wildly wrong numbers.\n\n> **Error-field warning.** On `traces-*.otel-*` the exception attributes use the `exception.*` namespace, **not** `error.*`. Querying `error.message` \u002F `error.type` against an OTel-native index returns `verification_exception: Unknown column [error.message], did you mean any of [exception.message, message]?`. The `error.*` family belongs only to classic-APM `traces-apm*` documents. When you see the user ask \"show me the error messages from X\", reach for `exception.message` first.\n\n> **Where exception data actually lives — three deployment shapes.** OTel records exceptions as Span Events; *where they end up indexed* depends on the exporter pipeline:\n>\n> 1. **Flattened onto the trace doc** — the parent span carries `exception.message`, `exception.type`, `exception.stacktrace`. Common with EDOT + APM Server. Query `traces-*.otel-*`.\n> 2. **Exported as separate log records** — `logs-*.otel-*` carries `exception.message` \u002F `exception.type`, correlated to the trace via `trace.id` and `span.id`. This is the *default* OpenTelemetry Collector pipeline. The trace doc itself only carries `status.message` \u002F `status.code` (`Error` on failed spans).\n> 3. **Classic APM `error` events** — `traces-apm*` with `processor.event == \"error\"` carries `error.message` and `error.exception.type`. Only present when classic-APM agents are in use.\n>\n> The trace doc always carries `event.outcome == \"failure\"` and `status.message` regardless. If your `exception.message` query against `traces-*.otel-*` returns `Unknown column [exception.message]`, the deployment is shape 2 — switch to `logs-*.otel-*` with `WHERE exception.message IS NOT NULL` and join back to the trace via `trace.id` if needed. Don't assume the original index has the field just because the user said \"from traces\".\n\nService p95 latency (OTel-native), last 15m — result in ms:\n\n```\nFROM traces-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND kind == \"Server\"\n| STATS p95_ms = PERCENTILE(duration, 95) \u002F 1000000\n```\n\nError rate for a service — `event.outcome` is reliable here:\n\n```\nFROM traces-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND kind == \"Server\"\n| STATS errors = COUNT(*) WHERE event.outcome == \"failure\", total = COUNT(*)\n| EVAL error_rate_pct = ROUND(errors * 100.0 \u002F total, 2)\n| KEEP error_rate_pct, errors, total\n```\n\nRecent exception messages — try the trace index first (flattened-event pipelines), then fall back to logs (default OTel Collector pipeline):\n\n**1) Trace doc carries the exception (EDOT-flattened pipelines):**\n\n```\nFROM traces-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND event.outcome == \"failure\"\n AND exception.message IS NOT NULL\n| KEEP @timestamp, exception.type, exception.message\n| SORT @timestamp DESC\n| LIMIT 50\n```\n\n**2) Exception lives in logs (default OTel pipeline) — use this when (1) returns `Unknown column [exception.message]` or empty:**\n\n```\nFROM logs-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND exception.message IS NOT NULL\n| KEEP @timestamp, exception.type, exception.message, trace.id, span.id\n| SORT @timestamp DESC\n| LIMIT 50\n```\n\n**3) Classic-APM equivalent — only when both OTel paths return empty:**\n\n```\nFROM traces-apm*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND processor.event == \"error\"\n| KEEP @timestamp, error.exception.type, error.message\n| SORT @timestamp DESC\n| LIMIT 50\n```\n\nIf `traces-*.otel-*` returns empty, the deployment is classic-APM-only — fall back to `traces-apm*` with `processor.event == \"transaction\"` and `transaction.duration.us`.\n\n**Throughput trend — use the pre-aggregated rollup when possible.** `metrics-service_summary.1m.otel-*` carries per-minute request counts in `service_summary` (a regular `long`, designed to `SUM`). Cheaper and faster than scanning raw traces for \"how many requests\u002Fmin over the last hour\":\n\n```\nFROM metrics-service_summary.1m.otel-*\n| WHERE service.name == \"frontend\" AND @timestamp > NOW() - 1 hour\n| STATS throughput = SUM(service_summary)\n BY bucket = BUCKET(@timestamp, 1 minute)\n| SORT bucket ASC\n```\n\n### Log rate\n\nIndex: `logs-*`\n\n```\nFROM logs-*\n| WHERE service.name == \"cartservice\" AND @timestamp > NOW() - 5m\n| STATS v = COUNT(*)\n```\n\n### Query-construction rules\n\n- For `now` and `metric` mode, the query must return a single row with a numeric first column —\n the tool reads the first numeric cell. For `table` mode this restriction doesn't apply: any\n shape is fine.\n- Scope with `@timestamp > NOW() - \u003Cwindow>` when the user implies \"right now\" (default 5m is\n usually fine; let the window match the user's language).\n- When the user names a namespace, match it exactly (e.g. `oteldemo-esyox-default`, not\n `otel-demo`). If unsure, call `apm-health-summary` first — its `namespace_candidates` field\n surfaces fuzzy matches.\n- **String literals use double quotes only.** ES|QL does not accept single quotes — `WHERE kind == \"Server\"`, never `WHERE kind == 'Server'`. Single quotes cause `token recognition error` failures.\n- **Match the aggregation to the field's storage shape.** Three shapes to recognize:\n - **Gauges** (`memory.working_set`, `memory.available`, `cpu.usage`, `filesystem.usage` in\n `metrics-kubeletstatsreceiver.otel*`): use `AVG` \u002F `MAX` \u002F `MIN`. **Do not `SUM` a gauge** — it\n will add every ~15s kubelet sample over your window and inflate the value by hundreds or\n thousands.\n - **Counters** (`k8s.pod.network.io`, `k8s.node.uptime`, etc. — `counter_long` type): require\n `TS` + `RATE()`. See the \"Counter fields\" section above. `FROM` + `MAX`\u002F`AVG`\u002F`SUM` on a\n counter is a hard error, not a silent wrong number.\n - **Pre-aggregated rollups** (`service_summary` on `metrics-service_summary.1m.otel-*`,\n `span.destination.service.response_time.count` on `metrics-service_destination.1m.otel-*`):\n designed for `SUM` across the window. Each doc is already a per-minute bucket count.\n- **Use `CHANGE_POINT` to detect regime shifts automatically** on time-bucketed results rather than\n eyeballing the table. Append it after any `STATS ... BY BUCKET(@timestamp, interval)` query when\n the user asks about spikes, dips, or anomalies in a metric over time:\n\n ```\n FROM metrics-kubeletstatsreceiver.otel*\n | WHERE @timestamp > NOW() - 24 hours AND k8s.node.cpu.usage IS NOT NULL\n | STATS avg_cpu = AVG(k8s.node.cpu.usage) BY bucket = BUCKET(@timestamp, 1 hour)\n | SORT bucket ASC\n | CHANGE_POINT avg_cpu ON bucket\n | WHERE type IS NOT NULL\n ```\n\n `CHANGE_POINT` appends `type` (e.g. `step_change`, `spike`, `dip`) and `pvalue` columns. Filter\n `WHERE type IS NOT NULL` to surface only the detected change points. Works on any numeric\n time-bucketed series — CPU, memory, error rates, throughput.\n\n## After the tool returns\n\n`_setup_notice` is view-side chrome — don't echo or summarize it in chat. There are three\nvariants:\n- `welcome` and `skill-gap` are user-facing nudges to install the skill packs. Ignore them.\n- `schema-hint` is an actionable retry instruction the server emits when your query failed in a\n way the latest skill *expects* on this deployment shape (e.g. exceptions live in\n `logs-*.otel-*` instead of on the trace doc). Read its `message` and adapt your next call\n accordingly — don't surface the banner text in chat, but do follow its guidance.\n\nThe observe MCP App view renders inline in one of several modes, picked automatically from the result:\n\n- **Now mode (`status: NOW`)** — compact card: big unit-formatted number, ES|QL subtitle, \"evaluated\n Xs ago\" stamp, and three follow-up actions (re-check, escalate to live observation, create alert rule).\n- **Metric mode** — area + line + dots sparkline with optional threshold line; stat cards for\n current \u002F threshold \u002F peak \u002F baseline. Covers `CONDITION_MET`, `TIMEOUT`, and `SAMPLED`.\n- **Anomaly mode** — severity-scored trigger card with affected entities and click-to-send\n investigation prompts.\n- **Table mode (`status: TABLE`)** — styled HTML table with column headers, type-aware alignment\n (numeric right, text left), and zebra-striped rows. Row count + truncation notice in the subtitle.\n- **Error (`status: ERROR`)** — red-toned card with the ES|QL failure message verbatim. Surfaces\n instead of throwing when the query is bad (unknown field, index missing, syntax error).\n\nAll modes surface an `investigation_actions` list as buttons. Follow up in chat too — don't rely\non the buttons alone.\n\n### Status-by-status guidance\n\n- **`NOW`** — State the value plainly. Offer to escalate to a live observation if the user seems to\n want ongoing visibility.\n- **`TABLE`** — Summarize what the rows show (top entity, total count, any outliers). Don't just\n dump the full table back — the user can read the widget. If the result was truncated, say so and\n offer to tighten the ES|QL.\n- **`ERROR`** — Read the error message, explain what likely went wrong (unknown field, index\n pattern, syntax), and propose a corrected query. Don't retry blindly.\n- **`ALERT`** (anomaly fired) — The response includes affected entities, affected services, top\n anomalies, and `investigation_hints` naming the next tool to reach for. **Follow those hints\n immediately** — don't just report the alert, start investigating and narrate your reasoning.\n- **`CONDITION_MET`** (metric threshold satisfied) — Confirm to the user and describe the trend\n from the returned history. If this was post-remediation validation, explicitly state the fix has\n been validated. Offer to graduate the condition into a durable rule via `manage-alerts`.\n- **`SAMPLED`** (live sample completed without a condition) — Summarize the trend (trending up \u002F\n down \u002F flat, peak, typical). Offer \"keep observing\" (extend window) or graduate to an alert rule.\n- **`TIMEOUT`** (metric condition never met) — Tell the user the metric didn't stabilize. Suggest\n follow-ups: check `ml-anomalies`, persist as alert rule, re-examine the ES|QL.\n- **`QUIET`** (anomaly mode, nothing fired) — Suggest adjustments: lower `min_score`, widen\n `lookback`, verify ML jobs are running.\n\n## Accumulating timelines\n\nEvery metric-mode response includes an `observe_key` derived from `esql + condition`. When Claude\nre-invokes observe with the same ES|QL (e.g. via the \"Extend observation (+60s)\" button), the view\nmerges the new samples into the existing sparkline instead of resetting — so the user sees a\ncontinuous timeline across multiple tool calls. To keep this continuity, reuse the exact same\nES|QL string and condition when extending. Capped at 240 points to keep the chart readable.\n\n## Tools\n\n| Tool | Purpose |\n|------|---------|\n| `observe` | Polls and blocks. Four modes: `anomaly`, `metric`, `now`, `table`. |\n| `ml-anomalies` | Follow-up: deeper look at the anomaly that fired. |\n| `apm-service-dependencies` | Follow-up: topology of affected services (if APM available). |\n| `apm-health-summary` | Follow-up: cluster-wide context, and useful for discovering which namespaces actually have data. |\n| `k8s-blast-radius` | Follow-up: infra impact if a node is implicated. |\n| `manage-alerts` | Graduate to persistent alerting once the pattern is well-understood. |\n\n## Key principles\n\n- **Observe is transient.** Nothing is saved. If the user wants an ongoing rule, use `manage-alerts`.\n- **Pick the mode from the user's phrasing.** \"What is X right now\" (scalar) → `now`. \"Show me a\n live chart of X\" or \"watch X for 60s\" → `metric` (no condition). \"Wait until X drops below Y\" →\n `metric` (with condition). \"Tell me when anything unusual fires\" → `anomaly`. \"List …\", \"which\n pods are on node X\", \"top N by Y\" → `table`. If a user asks \"what is X\" and X is actually a list\n or grouping (not a single number), pick `table`, not `now`.\n- **Use the known field paths.** Don't probe generic `metrics-*` patterns when the deployment\n indexes under `metrics-kubeletstatsreceiver.otel*`. The cheat sheet above is authoritative for\n this environment.\n- **On ALERT, start investigating immediately.** The `investigation_hints` are suggestions —\n follow them and narrate your reasoning.\n- **Don't start with `observe` for vague triage.** If the user reports a symptom without naming a\n specific metric (\"something feels slow\", \"what's wrong with prod\"), reach for `apm-health-summary`\n first — it surfaces the worst-offender services without needing a query. `observe` needs a target\n metric to poll; use it to drill in *after* the rollup names something.\n- **Don't over-tune `min_score`.** 75 catches the important stuff; dropping below 50 produces noise.\n\n## Investigation discipline\n\n- **One tool call per turn.** After this tool returns, narrate the headline finding before the next call. Each call adds a widget — chaining several after one \"yes\" looks like a runaway agent.\n- **Sequential offers, not OR.** \"Want me to check X *or* Y?\" → \"Want me to start with X? If it's inconclusive I can follow up with Y.\" The user's \"yes\" then maps to one call, not both.\n- **Build queries from known fields.** Use the cheat-sheet above — don't guess field names. If an \"Unknown column\" error returns with a \"did you mean…\" suggestion, *read it* and adjust; don't blindly retry.\n",{"data":34,"body":35},{"name":4,"description":6},{"type":36,"children":37},"root",[38,46,84,91,98,110,297,409,415,499,505,511,679,712,718,929,978,984,1003,1172,1178,1317,1342,1482,1501,1507,1526,1650,1674,1814,1842,1848,1861,2076,2149,2154,2163,2169,2174,2271,2277,2287,2307,2341,2607,2634,2644,2752,2785,2801,2925,2943,2951,2956,2965,2970,2979,2998,3007,3012,3021,3034,3043,3055,3072,3286,3343,3398,3403,3534,3585,3594,3652,3726,3735,3740,3876,3894,3903,3909,3928,3988,4283,4323,4407,4642,4647,4656,4668,4677,4682,4690,4699,4714,4723,4731,4740,4770,4809,4818,4824,4833,4842,4848,5247,5253,5264,5317,5322,5417,5430,5436,5592,5598,5619,5625,5769,5775,5946,5952,5999],{"type":39,"tag":40,"props":41,"children":42},"element","h1",{"id":4},[43],{"type":44,"value":45},"text","Observe",{"type":39,"tag":47,"props":48,"children":49},"p",{},[50,52,59,61,66,68,74,76,82],{"type":44,"value":51},"Transient, session-scoped monitoring and ad-hoc querying. Unlike ",{"type":39,"tag":53,"props":54,"children":56},"code",{"className":55},[],[57],{"type":44,"value":58},"manage-alerts",{"type":44,"value":60}," (which\ncreates a durable saved object in Kibana), ",{"type":39,"tag":53,"props":62,"children":64},{"className":63},[],[65],{"type":44,"value":4},{"type":44,"value":67}," polls in-process and returns once fired,\nonce its window closes, or — in ",{"type":39,"tag":53,"props":69,"children":71},{"className":70},[],[72],{"type":44,"value":73},"now",{"type":44,"value":75}," \u002F ",{"type":39,"tag":53,"props":77,"children":79},{"className":78},[],[80],{"type":44,"value":81},"table",{"type":44,"value":83}," mode — immediately.",{"type":39,"tag":85,"props":86,"children":88},"h2",{"id":87},"modes",[89],{"type":44,"value":90},"Modes",{"type":39,"tag":92,"props":93,"children":95},"h3",{"id":94},"decision-tree-pick-based-on-tense-first-then-on-shape",[96],{"type":44,"value":97},"Decision tree — pick based on tense FIRST, then on shape",{"type":39,"tag":99,"props":100,"children":104},"pre",{"className":101,"code":103,"language":44},[102],"language-text","Does the user phrase it as past or future?\n\nPAST tense \u002F windowed lookback FUTURE tense \u002F live monitoring\n(\"what WAS \u002F over the past N \u002F (\"watch \u002F monitor \u002F wait until \u002F\n in the last N \u002F how did X look\") live-sample \u002F for the NEXT N\")\n │ │\n ▼ ▼\nIs it a single number or a series? Is there a threshold to fire on?\n │ │\n ┌───┴────┐ ┌──┴──┐\nsingle series yes no\n │ │ │ │\n ▼ ▼ ▼ ▼\n now table metric metric\n (with (live-\n condition) sample)\n\nOther:\n • \"tell me when anything unusual fires\" → anomaly (default)\n • \"list X \u002F which X are Y \u002F top N\" (any tense) → table\n • \"page me whenever...\" → use manage-alerts instead\n",[105],{"type":39,"tag":53,"props":106,"children":108},{"__ignoreMap":107},"",[109],{"type":44,"value":103},{"type":39,"tag":81,"props":111,"children":112},{},[113,137],{"type":39,"tag":114,"props":115,"children":116},"thead",{},[117],{"type":39,"tag":118,"props":119,"children":120},"tr",{},[121,127,132],{"type":39,"tag":122,"props":123,"children":124},"th",{},[125],{"type":44,"value":126},"Mode",{"type":39,"tag":122,"props":128,"children":129},{},[130],{"type":44,"value":131},"When to pick it",{"type":39,"tag":122,"props":133,"children":134},{},[135],{"type":44,"value":136},"Blocks?",{"type":39,"tag":138,"props":139,"children":140},"tbody",{},[141,177,210,266],{"type":39,"tag":118,"props":142,"children":143},{},[144,153,172],{"type":39,"tag":145,"props":146,"children":147},"td",{},[148],{"type":39,"tag":53,"props":149,"children":151},{"className":150},[],[152],{"type":44,"value":73},{"type":39,"tag":145,"props":154,"children":155},{},[156,162,164,170],{"type":39,"tag":157,"props":158,"children":159},"strong",{},[160],{"type":44,"value":161},"Past-tense windowed scalar.",{"type":44,"value":163}," \"What was X right now \u002F over the past 60 seconds \u002F in the last 15 minutes \u002F average X for the last hour\". Put the window inside the ES|QL via ",{"type":39,"tag":53,"props":165,"children":167},{"className":166},[],[168],{"type":44,"value":169},"WHERE @timestamp > NOW() - \u003Cwindow>",{"type":44,"value":171},". Single number out.",{"type":39,"tag":145,"props":173,"children":174},{},[175],{"type":44,"value":176},"Returns immediately",{"type":39,"tag":118,"props":178,"children":179},{},[180,188,206],{"type":39,"tag":145,"props":181,"children":182},{},[183],{"type":39,"tag":53,"props":184,"children":186},{"className":185},[],[187],{"type":44,"value":81},{"type":39,"tag":145,"props":189,"children":190},{},[191,196,198,204],{"type":39,"tag":157,"props":192,"children":193},{},[194],{"type":44,"value":195},"Past-tense time series OR group-by.",{"type":44,"value":197}," \"How did X look over the past hour\" (with ",{"type":39,"tag":53,"props":199,"children":201},{"className":200},[],[202],{"type":44,"value":203},"BUCKET()",{"type":44,"value":205}," for the chart), \"list X\", \"which X are Y\", any group-by \u002F top-N. The view auto-charts 2-column time-series tables.",{"type":39,"tag":145,"props":207,"children":208},{},[209],{"type":44,"value":176},{"type":39,"tag":118,"props":211,"children":212},{},[213,222,254],{"type":39,"tag":145,"props":214,"children":215},{},[216],{"type":39,"tag":53,"props":217,"children":219},{"className":218},[],[220],{"type":44,"value":221},"metric",{"type":39,"tag":145,"props":223,"children":224},{},[225,230,232,238,240,245,247,252],{"type":39,"tag":157,"props":226,"children":227},{},[228],{"type":44,"value":229},"Forward-looking only.",{"type":44,"value":231}," \"Watch X\", \"wait until X drops\", \"live-sample X for the next 60s\", \"wake me when X exceeds Y\". Polls live for ",{"type":39,"tag":53,"props":233,"children":235},{"className":234},[],[236],{"type":44,"value":237},"max_wait",{"type":44,"value":239}," seconds. ",{"type":39,"tag":157,"props":241,"children":242},{},[243],{"type":44,"value":244},"Never use this for past-tense \u002F \"what was X\" queries",{"type":44,"value":246}," — it will block for ",{"type":39,"tag":53,"props":248,"children":250},{"className":249},[],[251],{"type":44,"value":237},{"type":44,"value":253}," seconds before returning a value, which is the opposite of what the user asked.",{"type":39,"tag":145,"props":255,"children":256},{},[257,259,264],{"type":44,"value":258},"Polls for ",{"type":39,"tag":53,"props":260,"children":262},{"className":261},[],[263],{"type":44,"value":237},{"type":44,"value":265}," seconds (default 60s)",{"type":39,"tag":118,"props":267,"children":268},{},[269,280,285],{"type":39,"tag":145,"props":270,"children":271},{},[272,278],{"type":39,"tag":53,"props":273,"children":275},{"className":274},[],[276],{"type":44,"value":277},"anomaly",{"type":44,"value":279}," (default)",{"type":39,"tag":145,"props":281,"children":282},{},[283],{"type":44,"value":284},"\"Tell me when anything unusual fires\", open-ended monitoring",{"type":39,"tag":145,"props":286,"children":287},{},[288,290,295],{"type":44,"value":289},"Until an anomaly fires or ",{"type":39,"tag":53,"props":291,"children":293},{"className":292},[],[294],{"type":44,"value":237},{"type":44,"value":296}," elapses",{"type":39,"tag":298,"props":299,"children":300},"blockquote",{},[301,327,378,390],{"type":39,"tag":47,"props":302,"children":303},{},[304,306,318,320,325],{"type":44,"value":305},"⚠️ ",{"type":39,"tag":157,"props":307,"children":308},{},[309,311,316],{"type":44,"value":310},"Most common mistake: picking ",{"type":39,"tag":53,"props":312,"children":314},{"className":313},[],[315],{"type":44,"value":221},{"type":44,"value":317}," for a past-tense query.",{"type":44,"value":319}," A prompt like \"what was the frontend memory over the past 60 seconds?\" is asking about data that already exists — it's a windowed lookup, not a request to wait 60 more seconds and watch. Always inspect the verb before choosing ",{"type":39,"tag":53,"props":321,"children":323},{"className":322},[],[324],{"type":44,"value":221},{"type":44,"value":326},":",{"type":39,"tag":328,"props":329,"children":330},"ul",{},[331,363],{"type":39,"tag":332,"props":333,"children":334},"li",{},[335,340,342,347,349,354,356,361],{"type":39,"tag":157,"props":336,"children":337},{},[338],{"type":44,"value":339},"was \u002F were \u002F averaged \u002F hit \u002F spiked \u002F over the past \u002F in the last \u002F for the last",{"type":44,"value":341}," → ",{"type":39,"tag":53,"props":343,"children":345},{"className":344},[],[346],{"type":44,"value":73},{"type":44,"value":348}," or ",{"type":39,"tag":53,"props":350,"children":352},{"className":351},[],[353],{"type":44,"value":81},{"type":44,"value":355},". NEVER ",{"type":39,"tag":53,"props":357,"children":359},{"className":358},[],[360],{"type":44,"value":221},{"type":44,"value":362},".",{"type":39,"tag":332,"props":364,"children":365},{},[366,371,372,377],{"type":39,"tag":157,"props":367,"children":368},{},[369],{"type":44,"value":370},"watch \u002F monitor \u002F poll \u002F wait until \u002F wake me \u002F for the next \u002F until X happens \u002F live-sample",{"type":44,"value":341},{"type":39,"tag":53,"props":373,"children":375},{"className":374},[],[376],{"type":44,"value":221},{"type":44,"value":362},{"type":39,"tag":47,"props":379,"children":380},{},[381,383,388],{"type":44,"value":382},"If the user wants durable alerting (\"page me whenever...\"), use ",{"type":39,"tag":53,"props":384,"children":386},{"className":385},[],[387],{"type":44,"value":58},{"type":44,"value":389}," instead.",{"type":39,"tag":47,"props":391,"children":392},{},[393,394,399,401,407],{"type":44,"value":305},{"type":39,"tag":157,"props":395,"children":396},{},[397],{"type":44,"value":398},"Don't use observe for health rollups.",{"type":44,"value":400}," \"Show me the health of X\", \"status of the X\nenvironment\", \"how is X doing\" — even with a time qualifier like \"over the past hour\" — should\nroute to ",{"type":39,"tag":53,"props":402,"children":404},{"className":403},[],[405],{"type":44,"value":406},"apm-health-summary",{"type":44,"value":408},", not observe. observe is for raw-metric \u002F single-query investigations;\napm-health-summary returns the full rollup (degraded services, anomalies, pod resources). Pick\napm-health-summary whenever the user is asking a HEALTH question rather than a specific metric\nquestion.",{"type":39,"tag":85,"props":410,"children":412},{"id":411},"prerequisites",[413],{"type":44,"value":414},"Prerequisites",{"type":39,"tag":81,"props":416,"children":417},{},[418,433],{"type":39,"tag":114,"props":419,"children":420},{},[421],{"type":39,"tag":118,"props":422,"children":423},{},[424,428],{"type":39,"tag":122,"props":425,"children":426},{},[427],{"type":44,"value":126},{"type":39,"tag":122,"props":429,"children":430},{},[431],{"type":44,"value":432},"Requires",{"type":39,"tag":138,"props":434,"children":435},{},[436,452,468,483],{"type":39,"tag":118,"props":437,"children":438},{},[439,447],{"type":39,"tag":145,"props":440,"children":441},{},[442],{"type":39,"tag":53,"props":443,"children":445},{"className":444},[],[446],{"type":44,"value":277},{"type":39,"tag":145,"props":448,"children":449},{},[450],{"type":44,"value":451},"Elastic ML anomaly detection jobs",{"type":39,"tag":118,"props":453,"children":454},{},[455,463],{"type":39,"tag":145,"props":456,"children":457},{},[458],{"type":39,"tag":53,"props":459,"children":461},{"className":460},[],[462],{"type":44,"value":221},{"type":39,"tag":145,"props":464,"children":465},{},[466],{"type":44,"value":467},"Any ES|QL-queryable numeric field",{"type":39,"tag":118,"props":469,"children":470},{},[471,479],{"type":39,"tag":145,"props":472,"children":473},{},[474],{"type":39,"tag":53,"props":475,"children":477},{"className":476},[],[478],{"type":44,"value":73},{"type":39,"tag":145,"props":480,"children":481},{},[482],{"type":44,"value":467},{"type":39,"tag":118,"props":484,"children":485},{},[486,494],{"type":39,"tag":145,"props":487,"children":488},{},[489],{"type":39,"tag":53,"props":490,"children":492},{"className":491},[],[493],{"type":44,"value":81},{"type":39,"tag":145,"props":495,"children":496},{},[497],{"type":44,"value":498},"Any ES|QL-queryable data",{"type":39,"tag":85,"props":500,"children":502},{"id":501},"how-to-call-observe",[503],{"type":44,"value":504},"How to call observe",{"type":39,"tag":92,"props":506,"children":508},{"id":507},"anomaly-mode-default",[509],{"type":44,"value":510},"Anomaly mode (default)",{"type":39,"tag":99,"props":512,"children":516},{"className":513,"code":514,"language":515,"meta":107,"style":107},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n \"mode\": \"anomaly\",\n \"min_score\": 75,\n \"max_wait\": 600,\n \"namespace\": \"otel-demo\"\n}\n","json",[517],{"type":39,"tag":53,"props":518,"children":519},{"__ignoreMap":107},[520,532,575,606,635,670],{"type":39,"tag":521,"props":522,"children":525},"span",{"class":523,"line":524},"line",1,[526],{"type":39,"tag":521,"props":527,"children":529},{"style":528},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[530],{"type":44,"value":531},"{\n",{"type":39,"tag":521,"props":533,"children":535},{"class":523,"line":534},2,[536,541,547,552,556,561,566,570],{"type":39,"tag":521,"props":537,"children":538},{"style":528},[539],{"type":44,"value":540}," \"",{"type":39,"tag":521,"props":542,"children":544},{"style":543},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[545],{"type":44,"value":546},"mode",{"type":39,"tag":521,"props":548,"children":549},{"style":528},[550],{"type":44,"value":551},"\"",{"type":39,"tag":521,"props":553,"children":554},{"style":528},[555],{"type":44,"value":326},{"type":39,"tag":521,"props":557,"children":558},{"style":528},[559],{"type":44,"value":560}," \"",{"type":39,"tag":521,"props":562,"children":564},{"style":563},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[565],{"type":44,"value":277},{"type":39,"tag":521,"props":567,"children":568},{"style":528},[569],{"type":44,"value":551},{"type":39,"tag":521,"props":571,"children":572},{"style":528},[573],{"type":44,"value":574},",\n",{"type":39,"tag":521,"props":576,"children":578},{"class":523,"line":577},3,[579,583,588,592,596,602],{"type":39,"tag":521,"props":580,"children":581},{"style":528},[582],{"type":44,"value":540},{"type":39,"tag":521,"props":584,"children":585},{"style":543},[586],{"type":44,"value":587},"min_score",{"type":39,"tag":521,"props":589,"children":590},{"style":528},[591],{"type":44,"value":551},{"type":39,"tag":521,"props":593,"children":594},{"style":528},[595],{"type":44,"value":326},{"type":39,"tag":521,"props":597,"children":599},{"style":598},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[600],{"type":44,"value":601}," 75",{"type":39,"tag":521,"props":603,"children":604},{"style":528},[605],{"type":44,"value":574},{"type":39,"tag":521,"props":607,"children":609},{"class":523,"line":608},4,[610,614,618,622,626,631],{"type":39,"tag":521,"props":611,"children":612},{"style":528},[613],{"type":44,"value":540},{"type":39,"tag":521,"props":615,"children":616},{"style":543},[617],{"type":44,"value":237},{"type":39,"tag":521,"props":619,"children":620},{"style":528},[621],{"type":44,"value":551},{"type":39,"tag":521,"props":623,"children":624},{"style":528},[625],{"type":44,"value":326},{"type":39,"tag":521,"props":627,"children":628},{"style":598},[629],{"type":44,"value":630}," 600",{"type":39,"tag":521,"props":632,"children":633},{"style":528},[634],{"type":44,"value":574},{"type":39,"tag":521,"props":636,"children":638},{"class":523,"line":637},5,[639,643,648,652,656,660,665],{"type":39,"tag":521,"props":640,"children":641},{"style":528},[642],{"type":44,"value":540},{"type":39,"tag":521,"props":644,"children":645},{"style":543},[646],{"type":44,"value":647},"namespace",{"type":39,"tag":521,"props":649,"children":650},{"style":528},[651],{"type":44,"value":551},{"type":39,"tag":521,"props":653,"children":654},{"style":528},[655],{"type":44,"value":326},{"type":39,"tag":521,"props":657,"children":658},{"style":528},[659],{"type":44,"value":560},{"type":39,"tag":521,"props":661,"children":662},{"style":563},[663],{"type":44,"value":664},"otel-demo",{"type":39,"tag":521,"props":666,"children":667},{"style":528},[668],{"type":44,"value":669},"\"\n",{"type":39,"tag":521,"props":671,"children":673},{"class":523,"line":672},6,[674],{"type":39,"tag":521,"props":675,"children":676},{"style":528},[677],{"type":44,"value":678},"}\n",{"type":39,"tag":328,"props":680,"children":681},{},[682,692,702],{"type":39,"tag":332,"props":683,"children":684},{},[685,690],{"type":39,"tag":53,"props":686,"children":688},{"className":687},[],[689],{"type":44,"value":587},{"type":44,"value":691},": 75 default (major+), 50 for minor inclusion, 90 for critical-only.",{"type":39,"tag":332,"props":693,"children":694},{},[695,700],{"type":39,"tag":53,"props":696,"children":698},{"className":697},[],[699],{"type":44,"value":237},{"type":44,"value":701},": generous (600s default). Returns immediately on trigger — long waits are free.",{"type":39,"tag":332,"props":703,"children":704},{},[705,710],{"type":39,"tag":53,"props":706,"children":708},{"className":707},[],[709],{"type":44,"value":647},{"type":44,"value":711},": only if the user scopes to a K8s namespace.",{"type":39,"tag":92,"props":713,"children":715},{"id":714},"metric-mode-threshold-condition",[716],{"type":44,"value":717},"Metric mode — threshold condition",{"type":39,"tag":99,"props":719,"children":721},{"className":513,"code":720,"language":515,"meta":107,"style":107},"{\n \"mode\": \"metric\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.pod.name == \\\"frontend-7d4b8f9c5-x2k9m\\\" | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"condition\": \"\u003C 80000000\",\n \"description\": \"frontend pod memory working set\",\n \"max_wait\": 300\n}\n",[722],{"type":39,"tag":53,"props":723,"children":724},{"__ignoreMap":107},[725,732,767,824,861,898,922],{"type":39,"tag":521,"props":726,"children":727},{"class":523,"line":524},[728],{"type":39,"tag":521,"props":729,"children":730},{"style":528},[731],{"type":44,"value":531},{"type":39,"tag":521,"props":733,"children":734},{"class":523,"line":534},[735,739,743,747,751,755,759,763],{"type":39,"tag":521,"props":736,"children":737},{"style":528},[738],{"type":44,"value":540},{"type":39,"tag":521,"props":740,"children":741},{"style":543},[742],{"type":44,"value":546},{"type":39,"tag":521,"props":744,"children":745},{"style":528},[746],{"type":44,"value":551},{"type":39,"tag":521,"props":748,"children":749},{"style":528},[750],{"type":44,"value":326},{"type":39,"tag":521,"props":752,"children":753},{"style":528},[754],{"type":44,"value":560},{"type":39,"tag":521,"props":756,"children":757},{"style":563},[758],{"type":44,"value":221},{"type":39,"tag":521,"props":760,"children":761},{"style":528},[762],{"type":44,"value":551},{"type":39,"tag":521,"props":764,"children":765},{"style":528},[766],{"type":44,"value":574},{"type":39,"tag":521,"props":768,"children":769},{"class":523,"line":577},[770,774,779,783,787,791,796,802,807,811,816,820],{"type":39,"tag":521,"props":771,"children":772},{"style":528},[773],{"type":44,"value":540},{"type":39,"tag":521,"props":775,"children":776},{"style":543},[777],{"type":44,"value":778},"esql",{"type":39,"tag":521,"props":780,"children":781},{"style":528},[782],{"type":44,"value":551},{"type":39,"tag":521,"props":784,"children":785},{"style":528},[786],{"type":44,"value":326},{"type":39,"tag":521,"props":788,"children":789},{"style":528},[790],{"type":44,"value":560},{"type":39,"tag":521,"props":792,"children":793},{"style":563},[794],{"type":44,"value":795},"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.pod.name == ",{"type":39,"tag":521,"props":797,"children":799},{"style":798},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[800],{"type":44,"value":801},"\\\"",{"type":39,"tag":521,"props":803,"children":804},{"style":563},[805],{"type":44,"value":806},"frontend-7d4b8f9c5-x2k9m",{"type":39,"tag":521,"props":808,"children":809},{"style":798},[810],{"type":44,"value":801},{"type":39,"tag":521,"props":812,"children":813},{"style":563},[814],{"type":44,"value":815}," | STATS v = AVG(metrics.k8s.pod.memory.working_set)",{"type":39,"tag":521,"props":817,"children":818},{"style":528},[819],{"type":44,"value":551},{"type":39,"tag":521,"props":821,"children":822},{"style":528},[823],{"type":44,"value":574},{"type":39,"tag":521,"props":825,"children":826},{"class":523,"line":608},[827,831,836,840,844,848,853,857],{"type":39,"tag":521,"props":828,"children":829},{"style":528},[830],{"type":44,"value":540},{"type":39,"tag":521,"props":832,"children":833},{"style":543},[834],{"type":44,"value":835},"condition",{"type":39,"tag":521,"props":837,"children":838},{"style":528},[839],{"type":44,"value":551},{"type":39,"tag":521,"props":841,"children":842},{"style":528},[843],{"type":44,"value":326},{"type":39,"tag":521,"props":845,"children":846},{"style":528},[847],{"type":44,"value":560},{"type":39,"tag":521,"props":849,"children":850},{"style":563},[851],{"type":44,"value":852},"\u003C 80000000",{"type":39,"tag":521,"props":854,"children":855},{"style":528},[856],{"type":44,"value":551},{"type":39,"tag":521,"props":858,"children":859},{"style":528},[860],{"type":44,"value":574},{"type":39,"tag":521,"props":862,"children":863},{"class":523,"line":637},[864,868,873,877,881,885,890,894],{"type":39,"tag":521,"props":865,"children":866},{"style":528},[867],{"type":44,"value":540},{"type":39,"tag":521,"props":869,"children":870},{"style":543},[871],{"type":44,"value":872},"description",{"type":39,"tag":521,"props":874,"children":875},{"style":528},[876],{"type":44,"value":551},{"type":39,"tag":521,"props":878,"children":879},{"style":528},[880],{"type":44,"value":326},{"type":39,"tag":521,"props":882,"children":883},{"style":528},[884],{"type":44,"value":560},{"type":39,"tag":521,"props":886,"children":887},{"style":563},[888],{"type":44,"value":889},"frontend pod memory working set",{"type":39,"tag":521,"props":891,"children":892},{"style":528},[893],{"type":44,"value":551},{"type":39,"tag":521,"props":895,"children":896},{"style":528},[897],{"type":44,"value":574},{"type":39,"tag":521,"props":899,"children":900},{"class":523,"line":672},[901,905,909,913,917],{"type":39,"tag":521,"props":902,"children":903},{"style":528},[904],{"type":44,"value":540},{"type":39,"tag":521,"props":906,"children":907},{"style":543},[908],{"type":44,"value":237},{"type":39,"tag":521,"props":910,"children":911},{"style":528},[912],{"type":44,"value":551},{"type":39,"tag":521,"props":914,"children":915},{"style":528},[916],{"type":44,"value":326},{"type":39,"tag":521,"props":918,"children":919},{"style":598},[920],{"type":44,"value":921}," 300\n",{"type":39,"tag":521,"props":923,"children":924},{"class":523,"line":27},[925],{"type":39,"tag":521,"props":926,"children":927},{"style":528},[928],{"type":44,"value":678},{"type":39,"tag":47,"props":930,"children":931},{},[932,934,940,942,948,950,956,957,963,964,970,971,977],{"type":44,"value":933},"Condition format: ",{"type":39,"tag":53,"props":935,"children":937},{"className":936},[],[938],{"type":44,"value":939},"\u003Ccomparator> \u003Cthreshold>",{"type":44,"value":941}," — valid comparators: ",{"type":39,"tag":53,"props":943,"children":945},{"className":944},[],[946],{"type":44,"value":947},"\u003C",{"type":44,"value":949},", ",{"type":39,"tag":53,"props":951,"children":953},{"className":952},[],[954],{"type":44,"value":955},"\u003C=",{"type":44,"value":949},{"type":39,"tag":53,"props":958,"children":960},{"className":959},[],[961],{"type":44,"value":962},">",{"type":44,"value":949},{"type":39,"tag":53,"props":965,"children":967},{"className":966},[],[968],{"type":44,"value":969},">=",{"type":44,"value":949},{"type":39,"tag":53,"props":972,"children":974},{"className":973},[],[975],{"type":44,"value":976},"==",{"type":44,"value":362},{"type":39,"tag":92,"props":979,"children":981},{"id":980},"metric-mode-live-sample-no-threshold",[982],{"type":44,"value":983},"Metric mode — live sample (no threshold)",{"type":39,"tag":47,"props":985,"children":986},{},[987,989,994,996,1001],{"type":44,"value":988},"Omit ",{"type":39,"tag":53,"props":990,"children":992},{"className":991},[],[993],{"type":44,"value":835},{"type":44,"value":995}," and the tool live-samples for the full ",{"type":39,"tag":53,"props":997,"children":999},{"className":998},[],[1000],{"type":44,"value":237},{"type":44,"value":1002}," window — use for\n\"show me a live chart of X\" prompts. The view renders an accumulating sparkline.",{"type":39,"tag":99,"props":1004,"children":1006},{"className":513,"code":1005,"language":515,"meta":107,"style":107},"{\n \"mode\": \"metric\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.namespace.name == \\\"oteldemo-esyox-default\\\" | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"description\": \"oteldemo-esyox-default avg pod memory\",\n \"max_wait\": 60\n}\n",[1007],{"type":39,"tag":53,"props":1008,"children":1009},{"__ignoreMap":107},[1010,1017,1052,1105,1141,1165],{"type":39,"tag":521,"props":1011,"children":1012},{"class":523,"line":524},[1013],{"type":39,"tag":521,"props":1014,"children":1015},{"style":528},[1016],{"type":44,"value":531},{"type":39,"tag":521,"props":1018,"children":1019},{"class":523,"line":534},[1020,1024,1028,1032,1036,1040,1044,1048],{"type":39,"tag":521,"props":1021,"children":1022},{"style":528},[1023],{"type":44,"value":540},{"type":39,"tag":521,"props":1025,"children":1026},{"style":543},[1027],{"type":44,"value":546},{"type":39,"tag":521,"props":1029,"children":1030},{"style":528},[1031],{"type":44,"value":551},{"type":39,"tag":521,"props":1033,"children":1034},{"style":528},[1035],{"type":44,"value":326},{"type":39,"tag":521,"props":1037,"children":1038},{"style":528},[1039],{"type":44,"value":560},{"type":39,"tag":521,"props":1041,"children":1042},{"style":563},[1043],{"type":44,"value":221},{"type":39,"tag":521,"props":1045,"children":1046},{"style":528},[1047],{"type":44,"value":551},{"type":39,"tag":521,"props":1049,"children":1050},{"style":528},[1051],{"type":44,"value":574},{"type":39,"tag":521,"props":1053,"children":1054},{"class":523,"line":577},[1055,1059,1063,1067,1071,1075,1080,1084,1089,1093,1097,1101],{"type":39,"tag":521,"props":1056,"children":1057},{"style":528},[1058],{"type":44,"value":540},{"type":39,"tag":521,"props":1060,"children":1061},{"style":543},[1062],{"type":44,"value":778},{"type":39,"tag":521,"props":1064,"children":1065},{"style":528},[1066],{"type":44,"value":551},{"type":39,"tag":521,"props":1068,"children":1069},{"style":528},[1070],{"type":44,"value":326},{"type":39,"tag":521,"props":1072,"children":1073},{"style":528},[1074],{"type":44,"value":560},{"type":39,"tag":521,"props":1076,"children":1077},{"style":563},[1078],{"type":44,"value":1079},"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.namespace.name == ",{"type":39,"tag":521,"props":1081,"children":1082},{"style":798},[1083],{"type":44,"value":801},{"type":39,"tag":521,"props":1085,"children":1086},{"style":563},[1087],{"type":44,"value":1088},"oteldemo-esyox-default",{"type":39,"tag":521,"props":1090,"children":1091},{"style":798},[1092],{"type":44,"value":801},{"type":39,"tag":521,"props":1094,"children":1095},{"style":563},[1096],{"type":44,"value":815},{"type":39,"tag":521,"props":1098,"children":1099},{"style":528},[1100],{"type":44,"value":551},{"type":39,"tag":521,"props":1102,"children":1103},{"style":528},[1104],{"type":44,"value":574},{"type":39,"tag":521,"props":1106,"children":1107},{"class":523,"line":608},[1108,1112,1116,1120,1124,1128,1133,1137],{"type":39,"tag":521,"props":1109,"children":1110},{"style":528},[1111],{"type":44,"value":540},{"type":39,"tag":521,"props":1113,"children":1114},{"style":543},[1115],{"type":44,"value":872},{"type":39,"tag":521,"props":1117,"children":1118},{"style":528},[1119],{"type":44,"value":551},{"type":39,"tag":521,"props":1121,"children":1122},{"style":528},[1123],{"type":44,"value":326},{"type":39,"tag":521,"props":1125,"children":1126},{"style":528},[1127],{"type":44,"value":560},{"type":39,"tag":521,"props":1129,"children":1130},{"style":563},[1131],{"type":44,"value":1132},"oteldemo-esyox-default avg pod memory",{"type":39,"tag":521,"props":1134,"children":1135},{"style":528},[1136],{"type":44,"value":551},{"type":39,"tag":521,"props":1138,"children":1139},{"style":528},[1140],{"type":44,"value":574},{"type":39,"tag":521,"props":1142,"children":1143},{"class":523,"line":637},[1144,1148,1152,1156,1160],{"type":39,"tag":521,"props":1145,"children":1146},{"style":528},[1147],{"type":44,"value":540},{"type":39,"tag":521,"props":1149,"children":1150},{"style":543},[1151],{"type":44,"value":237},{"type":39,"tag":521,"props":1153,"children":1154},{"style":528},[1155],{"type":44,"value":551},{"type":39,"tag":521,"props":1157,"children":1158},{"style":528},[1159],{"type":44,"value":326},{"type":39,"tag":521,"props":1161,"children":1162},{"style":598},[1163],{"type":44,"value":1164}," 60\n",{"type":39,"tag":521,"props":1166,"children":1167},{"class":523,"line":672},[1168],{"type":39,"tag":521,"props":1169,"children":1170},{"style":528},[1171],{"type":44,"value":678},{"type":39,"tag":92,"props":1173,"children":1175},{"id":1174},"now-mode-single-read",[1176],{"type":44,"value":1177},"Now mode — single read",{"type":39,"tag":99,"props":1179,"children":1181},{"className":513,"code":1180,"language":515,"meta":107,"style":107},"{\n \"mode\": \"now\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.namespace.name == \\\"oteldemo-esyox-default\\\" | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"description\": \"current avg pod memory in oteldemo-esyox-default\"\n}\n",[1182],{"type":39,"tag":53,"props":1183,"children":1184},{"__ignoreMap":107},[1185,1192,1227,1278,1310],{"type":39,"tag":521,"props":1186,"children":1187},{"class":523,"line":524},[1188],{"type":39,"tag":521,"props":1189,"children":1190},{"style":528},[1191],{"type":44,"value":531},{"type":39,"tag":521,"props":1193,"children":1194},{"class":523,"line":534},[1195,1199,1203,1207,1211,1215,1219,1223],{"type":39,"tag":521,"props":1196,"children":1197},{"style":528},[1198],{"type":44,"value":540},{"type":39,"tag":521,"props":1200,"children":1201},{"style":543},[1202],{"type":44,"value":546},{"type":39,"tag":521,"props":1204,"children":1205},{"style":528},[1206],{"type":44,"value":551},{"type":39,"tag":521,"props":1208,"children":1209},{"style":528},[1210],{"type":44,"value":326},{"type":39,"tag":521,"props":1212,"children":1213},{"style":528},[1214],{"type":44,"value":560},{"type":39,"tag":521,"props":1216,"children":1217},{"style":563},[1218],{"type":44,"value":73},{"type":39,"tag":521,"props":1220,"children":1221},{"style":528},[1222],{"type":44,"value":551},{"type":39,"tag":521,"props":1224,"children":1225},{"style":528},[1226],{"type":44,"value":574},{"type":39,"tag":521,"props":1228,"children":1229},{"class":523,"line":577},[1230,1234,1238,1242,1246,1250,1254,1258,1262,1266,1270,1274],{"type":39,"tag":521,"props":1231,"children":1232},{"style":528},[1233],{"type":44,"value":540},{"type":39,"tag":521,"props":1235,"children":1236},{"style":543},[1237],{"type":44,"value":778},{"type":39,"tag":521,"props":1239,"children":1240},{"style":528},[1241],{"type":44,"value":551},{"type":39,"tag":521,"props":1243,"children":1244},{"style":528},[1245],{"type":44,"value":326},{"type":39,"tag":521,"props":1247,"children":1248},{"style":528},[1249],{"type":44,"value":560},{"type":39,"tag":521,"props":1251,"children":1252},{"style":563},[1253],{"type":44,"value":1079},{"type":39,"tag":521,"props":1255,"children":1256},{"style":798},[1257],{"type":44,"value":801},{"type":39,"tag":521,"props":1259,"children":1260},{"style":563},[1261],{"type":44,"value":1088},{"type":39,"tag":521,"props":1263,"children":1264},{"style":798},[1265],{"type":44,"value":801},{"type":39,"tag":521,"props":1267,"children":1268},{"style":563},[1269],{"type":44,"value":815},{"type":39,"tag":521,"props":1271,"children":1272},{"style":528},[1273],{"type":44,"value":551},{"type":39,"tag":521,"props":1275,"children":1276},{"style":528},[1277],{"type":44,"value":574},{"type":39,"tag":521,"props":1279,"children":1280},{"class":523,"line":608},[1281,1285,1289,1293,1297,1301,1306],{"type":39,"tag":521,"props":1282,"children":1283},{"style":528},[1284],{"type":44,"value":540},{"type":39,"tag":521,"props":1286,"children":1287},{"style":543},[1288],{"type":44,"value":872},{"type":39,"tag":521,"props":1290,"children":1291},{"style":528},[1292],{"type":44,"value":551},{"type":39,"tag":521,"props":1294,"children":1295},{"style":528},[1296],{"type":44,"value":326},{"type":39,"tag":521,"props":1298,"children":1299},{"style":528},[1300],{"type":44,"value":560},{"type":39,"tag":521,"props":1302,"children":1303},{"style":563},[1304],{"type":44,"value":1305},"current avg pod memory in oteldemo-esyox-default",{"type":39,"tag":521,"props":1307,"children":1308},{"style":528},[1309],{"type":44,"value":669},{"type":39,"tag":521,"props":1311,"children":1312},{"class":523,"line":637},[1313],{"type":39,"tag":521,"props":1314,"children":1315},{"style":528},[1316],{"type":44,"value":678},{"type":39,"tag":47,"props":1318,"children":1319},{},[1320,1325,1327,1333,1335,1340],{"type":39,"tag":157,"props":1321,"children":1322},{},[1323],{"type":44,"value":1324},"Past-tense windowed read",{"type":44,"value":1326}," — when the user asks \"what was X over the past N seconds\u002Fminutes\u002Fhours\", put the window in the ES|QL ",{"type":39,"tag":53,"props":1328,"children":1330},{"className":1329},[],[1331],{"type":44,"value":1332},"WHERE",{"type":44,"value":1334}," clause, not in ",{"type":39,"tag":53,"props":1336,"children":1338},{"className":1337},[],[1339],{"type":44,"value":237},{"type":44,"value":1341},". The tool returns immediately with the aggregate; nothing is polled.",{"type":39,"tag":99,"props":1343,"children":1345},{"className":513,"code":1344,"language":515,"meta":107,"style":107},"{\n \"mode\": \"now\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.pod.name == \\\"frontend-7d4b8f9c5-x2k9m\\\" AND @timestamp > NOW() - 60 seconds | STATS v = AVG(metrics.k8s.pod.memory.working_set)\",\n \"description\": \"frontend memory, last 60 seconds (avg)\"\n}\n",[1346],{"type":39,"tag":53,"props":1347,"children":1348},{"__ignoreMap":107},[1349,1356,1391,1443,1475],{"type":39,"tag":521,"props":1350,"children":1351},{"class":523,"line":524},[1352],{"type":39,"tag":521,"props":1353,"children":1354},{"style":528},[1355],{"type":44,"value":531},{"type":39,"tag":521,"props":1357,"children":1358},{"class":523,"line":534},[1359,1363,1367,1371,1375,1379,1383,1387],{"type":39,"tag":521,"props":1360,"children":1361},{"style":528},[1362],{"type":44,"value":540},{"type":39,"tag":521,"props":1364,"children":1365},{"style":543},[1366],{"type":44,"value":546},{"type":39,"tag":521,"props":1368,"children":1369},{"style":528},[1370],{"type":44,"value":551},{"type":39,"tag":521,"props":1372,"children":1373},{"style":528},[1374],{"type":44,"value":326},{"type":39,"tag":521,"props":1376,"children":1377},{"style":528},[1378],{"type":44,"value":560},{"type":39,"tag":521,"props":1380,"children":1381},{"style":563},[1382],{"type":44,"value":73},{"type":39,"tag":521,"props":1384,"children":1385},{"style":528},[1386],{"type":44,"value":551},{"type":39,"tag":521,"props":1388,"children":1389},{"style":528},[1390],{"type":44,"value":574},{"type":39,"tag":521,"props":1392,"children":1393},{"class":523,"line":577},[1394,1398,1402,1406,1410,1414,1418,1422,1426,1430,1435,1439],{"type":39,"tag":521,"props":1395,"children":1396},{"style":528},[1397],{"type":44,"value":540},{"type":39,"tag":521,"props":1399,"children":1400},{"style":543},[1401],{"type":44,"value":778},{"type":39,"tag":521,"props":1403,"children":1404},{"style":528},[1405],{"type":44,"value":551},{"type":39,"tag":521,"props":1407,"children":1408},{"style":528},[1409],{"type":44,"value":326},{"type":39,"tag":521,"props":1411,"children":1412},{"style":528},[1413],{"type":44,"value":560},{"type":39,"tag":521,"props":1415,"children":1416},{"style":563},[1417],{"type":44,"value":795},{"type":39,"tag":521,"props":1419,"children":1420},{"style":798},[1421],{"type":44,"value":801},{"type":39,"tag":521,"props":1423,"children":1424},{"style":563},[1425],{"type":44,"value":806},{"type":39,"tag":521,"props":1427,"children":1428},{"style":798},[1429],{"type":44,"value":801},{"type":39,"tag":521,"props":1431,"children":1432},{"style":563},[1433],{"type":44,"value":1434}," AND @timestamp > NOW() - 60 seconds | STATS v = AVG(metrics.k8s.pod.memory.working_set)",{"type":39,"tag":521,"props":1436,"children":1437},{"style":528},[1438],{"type":44,"value":551},{"type":39,"tag":521,"props":1440,"children":1441},{"style":528},[1442],{"type":44,"value":574},{"type":39,"tag":521,"props":1444,"children":1445},{"class":523,"line":608},[1446,1450,1454,1458,1462,1466,1471],{"type":39,"tag":521,"props":1447,"children":1448},{"style":528},[1449],{"type":44,"value":540},{"type":39,"tag":521,"props":1451,"children":1452},{"style":543},[1453],{"type":44,"value":872},{"type":39,"tag":521,"props":1455,"children":1456},{"style":528},[1457],{"type":44,"value":551},{"type":39,"tag":521,"props":1459,"children":1460},{"style":528},[1461],{"type":44,"value":326},{"type":39,"tag":521,"props":1463,"children":1464},{"style":528},[1465],{"type":44,"value":560},{"type":39,"tag":521,"props":1467,"children":1468},{"style":563},[1469],{"type":44,"value":1470},"frontend memory, last 60 seconds (avg)",{"type":39,"tag":521,"props":1472,"children":1473},{"style":528},[1474],{"type":44,"value":669},{"type":39,"tag":521,"props":1476,"children":1477},{"class":523,"line":637},[1478],{"type":39,"tag":521,"props":1479,"children":1480},{"style":528},[1481],{"type":44,"value":678},{"type":39,"tag":47,"props":1483,"children":1484},{},[1485,1487,1492,1494,1499],{"type":44,"value":1486},"If the user wants the time series (not just one number), use ",{"type":39,"tag":53,"props":1488,"children":1490},{"className":1489},[],[1491],{"type":44,"value":81},{"type":44,"value":1493}," mode with ",{"type":39,"tag":53,"props":1495,"children":1497},{"className":1496},[],[1498],{"type":44,"value":203},{"type":44,"value":1500}," instead — that returns rows the view can chart.",{"type":39,"tag":92,"props":1502,"children":1504},{"id":1503},"table-mode-full-esql-rows-and-columns",[1505],{"type":44,"value":1506},"Table mode — full ES|QL rows and columns",{"type":39,"tag":47,"props":1508,"children":1509},{},[1510,1512,1517,1519,1524],{"type":44,"value":1511},"Use when the query groups, lists, or returns mixed-type rows (strings + numbers + dates). ",{"type":39,"tag":53,"props":1513,"children":1515},{"className":1514},[],[1516],{"type":44,"value":73},{"type":44,"value":1518}," mode\ndiscards everything except the first numeric cell — ",{"type":39,"tag":53,"props":1520,"children":1522},{"className":1521},[],[1523],{"type":44,"value":81},{"type":44,"value":1525}," mode preserves the whole result.",{"type":39,"tag":99,"props":1527,"children":1529},{"className":513,"code":1528,"language":515,"meta":107,"style":107},"{\n \"mode\": \"table\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE metrics.k8s.pod.memory.working_set IS NOT NULL | STATS avg_mem = AVG(metrics.k8s.pod.memory.working_set) BY resource.attributes.k8s.pod.name, resource.attributes.k8s.namespace.name | SORT avg_mem DESC | LIMIT 10\",\n \"description\": \"top 10 pods by memory\"\n}\n",[1530],{"type":39,"tag":53,"props":1531,"children":1532},{"__ignoreMap":107},[1533,1540,1575,1611,1643],{"type":39,"tag":521,"props":1534,"children":1535},{"class":523,"line":524},[1536],{"type":39,"tag":521,"props":1537,"children":1538},{"style":528},[1539],{"type":44,"value":531},{"type":39,"tag":521,"props":1541,"children":1542},{"class":523,"line":534},[1543,1547,1551,1555,1559,1563,1567,1571],{"type":39,"tag":521,"props":1544,"children":1545},{"style":528},[1546],{"type":44,"value":540},{"type":39,"tag":521,"props":1548,"children":1549},{"style":543},[1550],{"type":44,"value":546},{"type":39,"tag":521,"props":1552,"children":1553},{"style":528},[1554],{"type":44,"value":551},{"type":39,"tag":521,"props":1556,"children":1557},{"style":528},[1558],{"type":44,"value":326},{"type":39,"tag":521,"props":1560,"children":1561},{"style":528},[1562],{"type":44,"value":560},{"type":39,"tag":521,"props":1564,"children":1565},{"style":563},[1566],{"type":44,"value":81},{"type":39,"tag":521,"props":1568,"children":1569},{"style":528},[1570],{"type":44,"value":551},{"type":39,"tag":521,"props":1572,"children":1573},{"style":528},[1574],{"type":44,"value":574},{"type":39,"tag":521,"props":1576,"children":1577},{"class":523,"line":577},[1578,1582,1586,1590,1594,1598,1603,1607],{"type":39,"tag":521,"props":1579,"children":1580},{"style":528},[1581],{"type":44,"value":540},{"type":39,"tag":521,"props":1583,"children":1584},{"style":543},[1585],{"type":44,"value":778},{"type":39,"tag":521,"props":1587,"children":1588},{"style":528},[1589],{"type":44,"value":551},{"type":39,"tag":521,"props":1591,"children":1592},{"style":528},[1593],{"type":44,"value":326},{"type":39,"tag":521,"props":1595,"children":1596},{"style":528},[1597],{"type":44,"value":560},{"type":39,"tag":521,"props":1599,"children":1600},{"style":563},[1601],{"type":44,"value":1602},"FROM metrics-kubeletstatsreceiver.otel* | WHERE metrics.k8s.pod.memory.working_set IS NOT NULL | STATS avg_mem = AVG(metrics.k8s.pod.memory.working_set) BY resource.attributes.k8s.pod.name, resource.attributes.k8s.namespace.name | SORT avg_mem DESC | LIMIT 10",{"type":39,"tag":521,"props":1604,"children":1605},{"style":528},[1606],{"type":44,"value":551},{"type":39,"tag":521,"props":1608,"children":1609},{"style":528},[1610],{"type":44,"value":574},{"type":39,"tag":521,"props":1612,"children":1613},{"class":523,"line":608},[1614,1618,1622,1626,1630,1634,1639],{"type":39,"tag":521,"props":1615,"children":1616},{"style":528},[1617],{"type":44,"value":540},{"type":39,"tag":521,"props":1619,"children":1620},{"style":543},[1621],{"type":44,"value":872},{"type":39,"tag":521,"props":1623,"children":1624},{"style":528},[1625],{"type":44,"value":551},{"type":39,"tag":521,"props":1627,"children":1628},{"style":528},[1629],{"type":44,"value":326},{"type":39,"tag":521,"props":1631,"children":1632},{"style":528},[1633],{"type":44,"value":560},{"type":39,"tag":521,"props":1635,"children":1636},{"style":563},[1637],{"type":44,"value":1638},"top 10 pods by memory",{"type":39,"tag":521,"props":1640,"children":1641},{"style":528},[1642],{"type":44,"value":669},{"type":39,"tag":521,"props":1644,"children":1645},{"class":523,"line":637},[1646],{"type":39,"tag":521,"props":1647,"children":1648},{"style":528},[1649],{"type":44,"value":678},{"type":39,"tag":47,"props":1651,"children":1652},{},[1653,1658,1660,1665,1667,1672],{"type":39,"tag":157,"props":1654,"children":1655},{},[1656],{"type":44,"value":1657},"Past-tense time series",{"type":44,"value":1659}," — use ",{"type":39,"tag":53,"props":1661,"children":1663},{"className":1662},[],[1664],{"type":44,"value":81},{"type":44,"value":1666}," with ",{"type":39,"tag":53,"props":1668,"children":1670},{"className":1669},[],[1671],{"type":44,"value":203},{"type":44,"value":1673}," to return one row per time slice the view can chart:",{"type":39,"tag":99,"props":1675,"children":1677},{"className":513,"code":1676,"language":515,"meta":107,"style":107},"{\n \"mode\": \"table\",\n \"esql\": \"FROM metrics-kubeletstatsreceiver.otel* | WHERE resource.attributes.k8s.pod.name == \\\"frontend-7d4b8f9c5-x2k9m\\\" AND @timestamp > NOW() - 60 seconds | STATS v = AVG(metrics.k8s.pod.memory.working_set) BY bucket = BUCKET(@timestamp, 5 second) | SORT bucket ASC\",\n \"description\": \"frontend memory · 60s · 5s buckets\"\n}\n",[1678],{"type":39,"tag":53,"props":1679,"children":1680},{"__ignoreMap":107},[1681,1688,1723,1775,1807],{"type":39,"tag":521,"props":1682,"children":1683},{"class":523,"line":524},[1684],{"type":39,"tag":521,"props":1685,"children":1686},{"style":528},[1687],{"type":44,"value":531},{"type":39,"tag":521,"props":1689,"children":1690},{"class":523,"line":534},[1691,1695,1699,1703,1707,1711,1715,1719],{"type":39,"tag":521,"props":1692,"children":1693},{"style":528},[1694],{"type":44,"value":540},{"type":39,"tag":521,"props":1696,"children":1697},{"style":543},[1698],{"type":44,"value":546},{"type":39,"tag":521,"props":1700,"children":1701},{"style":528},[1702],{"type":44,"value":551},{"type":39,"tag":521,"props":1704,"children":1705},{"style":528},[1706],{"type":44,"value":326},{"type":39,"tag":521,"props":1708,"children":1709},{"style":528},[1710],{"type":44,"value":560},{"type":39,"tag":521,"props":1712,"children":1713},{"style":563},[1714],{"type":44,"value":81},{"type":39,"tag":521,"props":1716,"children":1717},{"style":528},[1718],{"type":44,"value":551},{"type":39,"tag":521,"props":1720,"children":1721},{"style":528},[1722],{"type":44,"value":574},{"type":39,"tag":521,"props":1724,"children":1725},{"class":523,"line":577},[1726,1730,1734,1738,1742,1746,1750,1754,1758,1762,1767,1771],{"type":39,"tag":521,"props":1727,"children":1728},{"style":528},[1729],{"type":44,"value":540},{"type":39,"tag":521,"props":1731,"children":1732},{"style":543},[1733],{"type":44,"value":778},{"type":39,"tag":521,"props":1735,"children":1736},{"style":528},[1737],{"type":44,"value":551},{"type":39,"tag":521,"props":1739,"children":1740},{"style":528},[1741],{"type":44,"value":326},{"type":39,"tag":521,"props":1743,"children":1744},{"style":528},[1745],{"type":44,"value":560},{"type":39,"tag":521,"props":1747,"children":1748},{"style":563},[1749],{"type":44,"value":795},{"type":39,"tag":521,"props":1751,"children":1752},{"style":798},[1753],{"type":44,"value":801},{"type":39,"tag":521,"props":1755,"children":1756},{"style":563},[1757],{"type":44,"value":806},{"type":39,"tag":521,"props":1759,"children":1760},{"style":798},[1761],{"type":44,"value":801},{"type":39,"tag":521,"props":1763,"children":1764},{"style":563},[1765],{"type":44,"value":1766}," AND @timestamp > NOW() - 60 seconds | STATS v = AVG(metrics.k8s.pod.memory.working_set) BY bucket = BUCKET(@timestamp, 5 second) | SORT bucket ASC",{"type":39,"tag":521,"props":1768,"children":1769},{"style":528},[1770],{"type":44,"value":551},{"type":39,"tag":521,"props":1772,"children":1773},{"style":528},[1774],{"type":44,"value":574},{"type":39,"tag":521,"props":1776,"children":1777},{"class":523,"line":608},[1778,1782,1786,1790,1794,1798,1803],{"type":39,"tag":521,"props":1779,"children":1780},{"style":528},[1781],{"type":44,"value":540},{"type":39,"tag":521,"props":1783,"children":1784},{"style":543},[1785],{"type":44,"value":872},{"type":39,"tag":521,"props":1787,"children":1788},{"style":528},[1789],{"type":44,"value":551},{"type":39,"tag":521,"props":1791,"children":1792},{"style":528},[1793],{"type":44,"value":326},{"type":39,"tag":521,"props":1795,"children":1796},{"style":528},[1797],{"type":44,"value":560},{"type":39,"tag":521,"props":1799,"children":1800},{"style":563},[1801],{"type":44,"value":1802},"frontend memory · 60s · 5s buckets",{"type":39,"tag":521,"props":1804,"children":1805},{"style":528},[1806],{"type":44,"value":669},{"type":39,"tag":521,"props":1808,"children":1809},{"class":523,"line":637},[1810],{"type":39,"tag":521,"props":1811,"children":1812},{"style":528},[1813],{"type":44,"value":678},{"type":39,"tag":47,"props":1815,"children":1816},{},[1817,1819,1825,1826,1832,1834,1840],{"type":44,"value":1818},"Rows are capped at 50 by default. Prefer tightening the ES|QL with ",{"type":39,"tag":53,"props":1820,"children":1822},{"className":1821},[],[1823],{"type":44,"value":1824},"LIMIT",{"type":44,"value":75},{"type":39,"tag":53,"props":1827,"children":1829},{"className":1828},[],[1830],{"type":44,"value":1831},"SORT",{"type":44,"value":1833}," over raising\n",{"type":39,"tag":53,"props":1835,"children":1837},{"className":1836},[],[1838],{"type":44,"value":1839},"row_cap",{"type":44,"value":1841}," — very wide tables clog the context window.",{"type":39,"tag":85,"props":1843,"children":1845},{"id":1844},"picking-the-right-index-pattern",[1846],{"type":44,"value":1847},"Picking the right index pattern",{"type":39,"tag":47,"props":1849,"children":1850},{},[1851,1853,1859],{"type":44,"value":1852},"Fields live where the data is emitted — ES|QL rejects queries that reference a field the\ntarget index doesn't map (",{"type":39,"tag":53,"props":1854,"children":1856},{"className":1855},[],[1857],{"type":44,"value":1858},"verification_exception",{"type":44,"value":1860},"). Before writing the query, match the\nuser's question to the right layer:",{"type":39,"tag":81,"props":1862,"children":1863},{},[1864,1885],{"type":39,"tag":114,"props":1865,"children":1866},{},[1867],{"type":39,"tag":118,"props":1868,"children":1869},{},[1870,1875,1880],{"type":39,"tag":122,"props":1871,"children":1872},{},[1873],{"type":44,"value":1874},"User asks about…",{"type":39,"tag":122,"props":1876,"children":1877},{},[1878],{"type":44,"value":1879},"Index",{"type":39,"tag":122,"props":1881,"children":1882},{},[1883],{"type":44,"value":1884},"Carries",{"type":39,"tag":138,"props":1886,"children":1887},{},[1888,1944,1997,2036],{"type":39,"tag":118,"props":1889,"children":1890},{},[1891,1896,1912],{"type":39,"tag":145,"props":1892,"children":1893},{},[1894],{"type":44,"value":1895},"Node \u002F pod \u002F namespace topology, resource usage",{"type":39,"tag":145,"props":1897,"children":1898},{},[1899,1905,1906],{"type":39,"tag":53,"props":1900,"children":1902},{"className":1901},[],[1903],{"type":44,"value":1904},"metrics-kubeletstatsreceiver.otel*",{"type":44,"value":348},{"type":39,"tag":53,"props":1907,"children":1909},{"className":1908},[],[1910],{"type":44,"value":1911},"metrics-*",{"type":39,"tag":145,"props":1913,"children":1914},{},[1915,1921,1922,1928,1929,1935,1936,1942],{"type":39,"tag":53,"props":1916,"children":1918},{"className":1917},[],[1919],{"type":44,"value":1920},"k8s.node.name",{"type":44,"value":949},{"type":39,"tag":53,"props":1923,"children":1925},{"className":1924},[],[1926],{"type":44,"value":1927},"k8s.pod.name",{"type":44,"value":949},{"type":39,"tag":53,"props":1930,"children":1932},{"className":1931},[],[1933],{"type":44,"value":1934},"k8s.namespace.name",{"type":44,"value":949},{"type":39,"tag":53,"props":1937,"children":1939},{"className":1938},[],[1940],{"type":44,"value":1941},"service.name",{"type":44,"value":1943}," (via resource attrs), CPU\u002Fmemory\u002Ffs gauges",{"type":39,"tag":118,"props":1945,"children":1946},{},[1947,1952,1968],{"type":39,"tag":145,"props":1948,"children":1949},{},[1950],{"type":44,"value":1951},"Service behavior — latency, errors, throughput, spans",{"type":39,"tag":145,"props":1953,"children":1954},{},[1955,1961,1962],{"type":39,"tag":53,"props":1956,"children":1958},{"className":1957},[],[1959],{"type":44,"value":1960},"traces-*.otel-*",{"type":44,"value":348},{"type":39,"tag":53,"props":1963,"children":1965},{"className":1964},[],[1966],{"type":44,"value":1967},"traces-apm*",{"type":39,"tag":145,"props":1969,"children":1970},{},[1971,1976,1977,1983,1984,1990,1991],{"type":39,"tag":53,"props":1972,"children":1974},{"className":1973},[],[1975],{"type":44,"value":1941},{"type":44,"value":949},{"type":39,"tag":53,"props":1978,"children":1980},{"className":1979},[],[1981],{"type":44,"value":1982},"transaction.duration.us",{"type":44,"value":949},{"type":39,"tag":53,"props":1985,"children":1987},{"className":1986},[],[1988],{"type":44,"value":1989},"event.outcome",{"type":44,"value":949},{"type":39,"tag":53,"props":1992,"children":1994},{"className":1993},[],[1995],{"type":44,"value":1996},"span.*",{"type":39,"tag":118,"props":1998,"children":1999},{},[2000,2005,2014],{"type":39,"tag":145,"props":2001,"children":2002},{},[2003],{"type":44,"value":2004},"Log rate \u002F log content",{"type":39,"tag":145,"props":2006,"children":2007},{},[2008],{"type":39,"tag":53,"props":2009,"children":2011},{"className":2010},[],[2012],{"type":44,"value":2013},"logs-*",{"type":39,"tag":145,"props":2015,"children":2016},{},[2017,2023,2024,2030,2031],{"type":39,"tag":53,"props":2018,"children":2020},{"className":2019},[],[2021],{"type":44,"value":2022},"message",{"type":44,"value":949},{"type":39,"tag":53,"props":2025,"children":2027},{"className":2026},[],[2028],{"type":44,"value":2029},"log.level",{"type":44,"value":949},{"type":39,"tag":53,"props":2032,"children":2034},{"className":2033},[],[2035],{"type":44,"value":1941},{"type":39,"tag":118,"props":2037,"children":2038},{},[2039,2044,2053],{"type":39,"tag":145,"props":2040,"children":2041},{},[2042],{"type":44,"value":2043},"ML anomalies",{"type":39,"tag":145,"props":2045,"children":2046},{},[2047],{"type":39,"tag":53,"props":2048,"children":2050},{"className":2049},[],[2051],{"type":44,"value":2052},".ml-anomalies-*",{"type":39,"tag":145,"props":2054,"children":2055},{},[2056,2062,2063,2069,2070],{"type":39,"tag":53,"props":2057,"children":2059},{"className":2058},[],[2060],{"type":44,"value":2061},"record_score",{"type":44,"value":949},{"type":39,"tag":53,"props":2064,"children":2066},{"className":2065},[],[2067],{"type":44,"value":2068},"by_field_value",{"type":44,"value":949},{"type":39,"tag":53,"props":2071,"children":2073},{"className":2072},[],[2074],{"type":44,"value":2075},"partition_field_value",{"type":39,"tag":47,"props":2077,"children":2078},{},[2079,2081,2086,2088,2093,2095,2100,2102,2107,2109,2114,2116,2122,2127,2129,2134,2135,2140,2142,2147],{"type":44,"value":2080},"Cross-layer questions (\"which ",{"type":39,"tag":157,"props":2082,"children":2083},{},[2084],{"type":44,"value":2085},"node",{"type":44,"value":2087}," runs the most ",{"type":39,"tag":157,"props":2089,"children":2090},{},[2091],{"type":44,"value":2092},"services",{"type":44,"value":2094},"\") need the index that\ncarries ",{"type":39,"tag":157,"props":2096,"children":2097},{},[2098],{"type":44,"value":2099},"both",{"type":44,"value":2101}," fields — that's almost always ",{"type":39,"tag":53,"props":2103,"children":2105},{"className":2104},[],[2106],{"type":44,"value":1911},{"type":44,"value":2108},", because OTel resource\nattributes propagate through the Collector, so metrics docs carry ",{"type":39,"tag":53,"props":2110,"children":2112},{"className":2111},[],[2113],{"type":44,"value":1920},{"type":44,"value":2115}," ",{"type":39,"tag":2117,"props":2118,"children":2119},"em",{},[2120],{"type":44,"value":2121},"and",{"type":39,"tag":53,"props":2123,"children":2125},{"className":2124},[],[2126],{"type":44,"value":1941},{"type":44,"value":2128},". Trace indices (",{"type":39,"tag":53,"props":2130,"children":2132},{"className":2131},[],[2133],{"type":44,"value":1967},{"type":44,"value":949},{"type":39,"tag":53,"props":2136,"children":2138},{"className":2137},[],[2139],{"type":44,"value":1960},{"type":44,"value":2141},") don't carry infra\nattributes like ",{"type":39,"tag":53,"props":2143,"children":2145},{"className":2144},[],[2146],{"type":44,"value":1920},{"type":44,"value":2148}," — don't reach for them when the question is about nodes.",{"type":39,"tag":47,"props":2150,"children":2151},{},[2152],{"type":44,"value":2153},"Example: \"which node is running the most services\"",{"type":39,"tag":99,"props":2155,"children":2158},{"className":2156,"code":2157,"language":44},[102],"FROM metrics-*\n| WHERE @timestamp > NOW() - 5m AND k8s.node.name IS NOT NULL AND service.name IS NOT NULL\n| STATS service_count = COUNT_DISTINCT(service.name) BY k8s.node.name\n| SORT service_count DESC\n| LIMIT 20\n",[2159],{"type":39,"tag":53,"props":2160,"children":2161},{"__ignoreMap":107},[2162],{"type":44,"value":2157},{"type":39,"tag":85,"props":2164,"children":2166},{"id":2165},"common-query-patterns",[2167],{"type":44,"value":2168},"Common query patterns",{"type":39,"tag":47,"props":2170,"children":2171},{},[2172],{"type":44,"value":2173},"These are the field paths this deployment's data actually uses — prefer them over guessing.",{"type":39,"tag":298,"props":2175,"children":2176},{},[2177,2187],{"type":39,"tag":47,"props":2178,"children":2179},{},[2180,2182],{"type":44,"value":2181},"⛔ ",{"type":39,"tag":157,"props":2183,"children":2184},{},[2185],{"type":44,"value":2186},"BEFORE WRITING ANY QUERY — check the field type first:",{"type":39,"tag":47,"props":2188,"children":2189},{},[2190,2192,2198,2199,2210,2212,2218,2220,2226,2228,2233,2235,2240,2242,2248,2250,2256,2257,2263,2265,2270],{"type":44,"value":2191},"Look up the field you intend to aggregate in the tables below. If its type is ",{"type":39,"tag":53,"props":2193,"children":2195},{"className":2194},[],[2196],{"type":44,"value":2197},"counter_long",{"type":44,"value":949},{"type":39,"tag":157,"props":2200,"children":2201},{},[2202,2204],{"type":44,"value":2203},"stop — do not write ",{"type":39,"tag":53,"props":2205,"children":2207},{"className":2206},[],[2208],{"type":44,"value":2209},"FROM",{"type":44,"value":2211},". Use ",{"type":39,"tag":53,"props":2213,"children":2215},{"className":2214},[],[2216],{"type":44,"value":2217},"TS",{"type":44,"value":2219}," + ",{"type":39,"tag":53,"props":2221,"children":2223},{"className":2222},[],[2224],{"type":44,"value":2225},"RATE()",{"type":44,"value":2227}," as described in the \"Counter fields\" section. This is a hard syntax requirement: ",{"type":39,"tag":53,"props":2229,"children":2231},{"className":2230},[],[2232],{"type":44,"value":2209},{"type":44,"value":2234}," is rejected for ",{"type":39,"tag":53,"props":2236,"children":2238},{"className":2237},[],[2239],{"type":44,"value":2197},{"type":44,"value":2241}," fields regardless of which aggregation function you use, and the error cannot be fixed by changing ",{"type":39,"tag":53,"props":2243,"children":2245},{"className":2244},[],[2246],{"type":44,"value":2247},"AVG",{"type":44,"value":2249}," to ",{"type":39,"tag":53,"props":2251,"children":2253},{"className":2252},[],[2254],{"type":44,"value":2255},"MAX",{"type":44,"value":348},{"type":39,"tag":53,"props":2258,"children":2260},{"className":2259},[],[2261],{"type":44,"value":2262},"SUM",{"type":44,"value":2264},". The source command must be ",{"type":39,"tag":53,"props":2266,"children":2268},{"className":2267},[],[2269],{"type":44,"value":2217},{"type":44,"value":362},{"type":39,"tag":92,"props":2272,"children":2274},{"id":2273},"otel-kubernetes-kubeletstats-receiver",[2275],{"type":44,"value":2276},"OTel Kubernetes (kubeletstats receiver)",{"type":39,"tag":47,"props":2278,"children":2279},{},[2280,2282],{"type":44,"value":2281},"Index: ",{"type":39,"tag":53,"props":2283,"children":2285},{"className":2284},[],[2286],{"type":44,"value":1904},{"type":39,"tag":47,"props":2288,"children":2289},{},[2290,2292,2297,2299,2305],{"type":44,"value":2291},"Each kubeletstats scrape emits ",{"type":39,"tag":157,"props":2293,"children":2294},{},[2295],{"type":44,"value":2296},"separate documents per metric",{"type":44,"value":2298}," — a CPU doc, a memory doc, a network doc, etc. Always filter ",{"type":39,"tag":53,"props":2300,"children":2302},{"className":2301},[],[2303],{"type":44,"value":2304},"WHERE \u003Cfield> IS NOT NULL",{"type":44,"value":2306}," for the field you're aggregating, otherwise most rows carry nulls for it.",{"type":39,"tag":47,"props":2308,"children":2309},{},[2310],{"type":39,"tag":157,"props":2311,"children":2312},{},[2313,2315,2320,2321,2326,2327,2333,2335,2340],{"type":44,"value":2314},"Gauge fields — use ",{"type":39,"tag":53,"props":2316,"children":2318},{"className":2317},[],[2319],{"type":44,"value":2247},{"type":44,"value":75},{"type":39,"tag":53,"props":2322,"children":2324},{"className":2323},[],[2325],{"type":44,"value":2255},{"type":44,"value":75},{"type":39,"tag":53,"props":2328,"children":2330},{"className":2329},[],[2331],{"type":44,"value":2332},"MIN",{"type":44,"value":2334},", never ",{"type":39,"tag":53,"props":2336,"children":2338},{"className":2337},[],[2339],{"type":44,"value":2262},{"type":44,"value":326},{"type":39,"tag":81,"props":2342,"children":2343},{},[2344,2365],{"type":39,"tag":114,"props":2345,"children":2346},{},[2347],{"type":39,"tag":118,"props":2348,"children":2349},{},[2350,2355,2360],{"type":39,"tag":122,"props":2351,"children":2352},{},[2353],{"type":44,"value":2354},"Signal",{"type":39,"tag":122,"props":2356,"children":2357},{},[2358],{"type":44,"value":2359},"Field",{"type":39,"tag":122,"props":2361,"children":2362},{},[2363],{"type":44,"value":2364},"Type",{"type":39,"tag":138,"props":2366,"children":2367},{},[2368,2396,2422,2448,2476,2502,2528,2554,2581],{"type":39,"tag":118,"props":2369,"children":2370},{},[2371,2376,2385],{"type":39,"tag":145,"props":2372,"children":2373},{},[2374],{"type":44,"value":2375},"Pod memory working set",{"type":39,"tag":145,"props":2377,"children":2378},{},[2379],{"type":39,"tag":53,"props":2380,"children":2382},{"className":2381},[],[2383],{"type":44,"value":2384},"k8s.pod.memory.working_set",{"type":39,"tag":145,"props":2386,"children":2387},{},[2388,2394],{"type":39,"tag":53,"props":2389,"children":2391},{"className":2390},[],[2392],{"type":44,"value":2393},"long",{"type":44,"value":2395}," (bytes)",{"type":39,"tag":118,"props":2397,"children":2398},{},[2399,2404,2413],{"type":39,"tag":145,"props":2400,"children":2401},{},[2402],{"type":44,"value":2403},"Pod memory RSS",{"type":39,"tag":145,"props":2405,"children":2406},{},[2407],{"type":39,"tag":53,"props":2408,"children":2410},{"className":2409},[],[2411],{"type":44,"value":2412},"k8s.pod.memory.rss",{"type":39,"tag":145,"props":2414,"children":2415},{},[2416,2421],{"type":39,"tag":53,"props":2417,"children":2419},{"className":2418},[],[2420],{"type":44,"value":2393},{"type":44,"value":2395},{"type":39,"tag":118,"props":2423,"children":2424},{},[2425,2430,2439],{"type":39,"tag":145,"props":2426,"children":2427},{},[2428],{"type":44,"value":2429},"Pod memory available",{"type":39,"tag":145,"props":2431,"children":2432},{},[2433],{"type":39,"tag":53,"props":2434,"children":2436},{"className":2435},[],[2437],{"type":44,"value":2438},"k8s.pod.memory.available",{"type":39,"tag":145,"props":2440,"children":2441},{},[2442,2447],{"type":39,"tag":53,"props":2443,"children":2445},{"className":2444},[],[2446],{"type":44,"value":2393},{"type":44,"value":2395},{"type":39,"tag":118,"props":2449,"children":2450},{},[2451,2456,2465],{"type":39,"tag":145,"props":2452,"children":2453},{},[2454],{"type":44,"value":2455},"Pod CPU usage",{"type":39,"tag":145,"props":2457,"children":2458},{},[2459],{"type":39,"tag":53,"props":2460,"children":2462},{"className":2461},[],[2463],{"type":44,"value":2464},"k8s.pod.cpu.usage",{"type":39,"tag":145,"props":2466,"children":2467},{},[2468,2474],{"type":39,"tag":53,"props":2469,"children":2471},{"className":2470},[],[2472],{"type":44,"value":2473},"double",{"type":44,"value":2475}," (cores — 1.0 = one full core)",{"type":39,"tag":118,"props":2477,"children":2478},{},[2479,2484,2493],{"type":39,"tag":145,"props":2480,"children":2481},{},[2482],{"type":44,"value":2483},"Pod filesystem usage",{"type":39,"tag":145,"props":2485,"children":2486},{},[2487],{"type":39,"tag":53,"props":2488,"children":2490},{"className":2489},[],[2491],{"type":44,"value":2492},"k8s.pod.filesystem.usage",{"type":39,"tag":145,"props":2494,"children":2495},{},[2496,2501],{"type":39,"tag":53,"props":2497,"children":2499},{"className":2498},[],[2500],{"type":44,"value":2393},{"type":44,"value":2395},{"type":39,"tag":118,"props":2503,"children":2504},{},[2505,2510,2519],{"type":39,"tag":145,"props":2506,"children":2507},{},[2508],{"type":44,"value":2509},"Node memory working set",{"type":39,"tag":145,"props":2511,"children":2512},{},[2513],{"type":39,"tag":53,"props":2514,"children":2516},{"className":2515},[],[2517],{"type":44,"value":2518},"k8s.node.memory.working_set",{"type":39,"tag":145,"props":2520,"children":2521},{},[2522,2527],{"type":39,"tag":53,"props":2523,"children":2525},{"className":2524},[],[2526],{"type":44,"value":2393},{"type":44,"value":2395},{"type":39,"tag":118,"props":2529,"children":2530},{},[2531,2536,2545],{"type":39,"tag":145,"props":2532,"children":2533},{},[2534],{"type":44,"value":2535},"Node memory available",{"type":39,"tag":145,"props":2537,"children":2538},{},[2539],{"type":39,"tag":53,"props":2540,"children":2542},{"className":2541},[],[2543],{"type":44,"value":2544},"k8s.node.memory.available",{"type":39,"tag":145,"props":2546,"children":2547},{},[2548,2553],{"type":39,"tag":53,"props":2549,"children":2551},{"className":2550},[],[2552],{"type":44,"value":2393},{"type":44,"value":2395},{"type":39,"tag":118,"props":2555,"children":2556},{},[2557,2562,2571],{"type":39,"tag":145,"props":2558,"children":2559},{},[2560],{"type":44,"value":2561},"Node CPU usage",{"type":39,"tag":145,"props":2563,"children":2564},{},[2565],{"type":39,"tag":53,"props":2566,"children":2568},{"className":2567},[],[2569],{"type":44,"value":2570},"k8s.node.cpu.usage",{"type":39,"tag":145,"props":2572,"children":2573},{},[2574,2579],{"type":39,"tag":53,"props":2575,"children":2577},{"className":2576},[],[2578],{"type":44,"value":2473},{"type":44,"value":2580}," (cores)",{"type":39,"tag":118,"props":2582,"children":2583},{},[2584,2589,2598],{"type":39,"tag":145,"props":2585,"children":2586},{},[2587],{"type":44,"value":2588},"Node filesystem usage",{"type":39,"tag":145,"props":2590,"children":2591},{},[2592],{"type":39,"tag":53,"props":2593,"children":2595},{"className":2594},[],[2596],{"type":44,"value":2597},"k8s.node.filesystem.usage",{"type":39,"tag":145,"props":2599,"children":2600},{},[2601,2606],{"type":39,"tag":53,"props":2602,"children":2604},{"className":2603},[],[2605],{"type":44,"value":2393},{"type":44,"value":2395},{"type":39,"tag":298,"props":2608,"children":2609},{},[2610],{"type":39,"tag":47,"props":2611,"children":2612},{},[2613,2615,2620,2622,2627,2628,2633],{"type":44,"value":2614},"For ",{"type":39,"tag":157,"props":2616,"children":2617},{},[2618],{"type":44,"value":2619},"counter",{"type":44,"value":2621}," fields (network I\u002FO, network errors, uptime), see the \"Counter fields\" section below — these require ",{"type":39,"tag":53,"props":2623,"children":2625},{"className":2624},[],[2626],{"type":44,"value":2217},{"type":44,"value":2219},{"type":39,"tag":53,"props":2629,"children":2631},{"className":2630},[],[2632],{"type":44,"value":2225},{"type":44,"value":362},{"type":39,"tag":47,"props":2635,"children":2636},{},[2637,2642],{"type":39,"tag":157,"props":2638,"children":2639},{},[2640],{"type":44,"value":2641},"Fields that may NOT exist in every cluster's kubeletstats schema",{"type":44,"value":2643}," — depends on whether the OTel collector \u002F kubelet is configured to scrape pod-spec data:",{"type":39,"tag":81,"props":2645,"children":2646},{},[2647,2667],{"type":39,"tag":114,"props":2648,"children":2649},{},[2650],{"type":39,"tag":118,"props":2651,"children":2652},{},[2653,2657,2662],{"type":39,"tag":122,"props":2654,"children":2655},{},[2656],{"type":44,"value":2359},{"type":39,"tag":122,"props":2658,"children":2659},{},[2660],{"type":44,"value":2661},"When it's missing",{"type":39,"tag":122,"props":2663,"children":2664},{},[2665],{"type":44,"value":2666},"What to do",{"type":39,"tag":138,"props":2668,"children":2669},{},[2670,2700,2722],{"type":39,"tag":118,"props":2671,"children":2672},{},[2673,2682,2687],{"type":39,"tag":145,"props":2674,"children":2675},{},[2676],{"type":39,"tag":53,"props":2677,"children":2679},{"className":2678},[],[2680],{"type":44,"value":2681},"metrics.k8s.pod.cpu.limit",{"type":39,"tag":145,"props":2683,"children":2684},{},[2685],{"type":44,"value":2686},"Pods don't declare CPU limits, OR the collector isn't scraping pod-spec",{"type":39,"tag":145,"props":2688,"children":2689},{},[2690,2692,2698],{"type":44,"value":2691},"Don't reference it — use raw ",{"type":39,"tag":53,"props":2693,"children":2695},{"className":2694},[],[2696],{"type":44,"value":2697},"metrics.k8s.pod.cpu.usage",{"type":44,"value":2699}," and report cores instead of % utilization",{"type":39,"tag":118,"props":2701,"children":2702},{},[2703,2712,2717],{"type":39,"tag":145,"props":2704,"children":2705},{},[2706],{"type":39,"tag":53,"props":2707,"children":2709},{"className":2708},[],[2710],{"type":44,"value":2711},"metrics.k8s.pod.memory.limit",{"type":39,"tag":145,"props":2713,"children":2714},{},[2715],{"type":44,"value":2716},"Same as above for memory",{"type":39,"tag":145,"props":2718,"children":2719},{},[2720],{"type":44,"value":2721},"Same — report bytes instead of %",{"type":39,"tag":118,"props":2723,"children":2724},{},[2725,2734,2739],{"type":39,"tag":145,"props":2726,"children":2727},{},[2728],{"type":39,"tag":53,"props":2729,"children":2731},{"className":2730},[],[2732],{"type":44,"value":2733},"metrics.k8s.container.restart_count",{"type":39,"tag":145,"props":2735,"children":2736},{},[2737],{"type":44,"value":2738},"Collector isn't scraping pod-status (this is COMMON)",{"type":39,"tag":145,"props":2740,"children":2741},{},[2742,2744,2750],{"type":44,"value":2743},"Don't reference it. Use APM error rates or alert reasons as a proxy for \"things crashing.\" There is no canonical alternative field name (",{"type":39,"tag":53,"props":2745,"children":2747},{"className":2746},[],[2748],{"type":44,"value":2749},"k8s.pod.restarts",{"type":44,"value":2751}," is wrong — don't try it)",{"type":39,"tag":47,"props":2753,"children":2754},{},[2755,2760,2762,2768,2770,2776,2777,2783],{"type":39,"tag":157,"props":2756,"children":2757},{},[2758],{"type":44,"value":2759},"Schema-aware error recovery.",{"type":44,"value":2761}," When ESQL returns ",{"type":39,"tag":53,"props":2763,"children":2765},{"className":2764},[],[2766],{"type":44,"value":2767},"Unknown column [X], did you mean [Y, Z]?",{"type":44,"value":2769},", read the suggestion and retry with one of ",{"type":39,"tag":53,"props":2771,"children":2773},{"className":2772},[],[2774],{"type":44,"value":2775},"Y",{"type":44,"value":348},{"type":39,"tag":53,"props":2778,"children":2780},{"className":2779},[],[2781],{"type":44,"value":2782},"Z",{"type":44,"value":2784}," — don't blindly retry the same query or guess a different name from memory.",{"type":39,"tag":47,"props":2786,"children":2787},{},[2788],{"type":39,"tag":157,"props":2789,"children":2790},{},[2791,2793,2799],{"type":44,"value":2792},"Dimension fields — use for filtering and ",{"type":39,"tag":53,"props":2794,"children":2796},{"className":2795},[],[2797],{"type":44,"value":2798},"BY",{"type":44,"value":2800}," grouping:",{"type":39,"tag":81,"props":2802,"children":2803},{},[2804,2825],{"type":39,"tag":114,"props":2805,"children":2806},{},[2807],{"type":39,"tag":118,"props":2808,"children":2809},{},[2810,2815,2820],{"type":39,"tag":122,"props":2811,"children":2812},{},[2813],{"type":44,"value":2814},"Dimension",{"type":39,"tag":122,"props":2816,"children":2817},{},[2818],{"type":44,"value":2819},"Unprefixed",{"type":39,"tag":122,"props":2821,"children":2822},{},[2823],{"type":44,"value":2824},"Prefixed (equivalent)",{"type":39,"tag":138,"props":2826,"children":2827},{},[2828,2853,2878,2903],{"type":39,"tag":118,"props":2829,"children":2830},{},[2831,2836,2844],{"type":39,"tag":145,"props":2832,"children":2833},{},[2834],{"type":44,"value":2835},"Pod name",{"type":39,"tag":145,"props":2837,"children":2838},{},[2839],{"type":39,"tag":53,"props":2840,"children":2842},{"className":2841},[],[2843],{"type":44,"value":1927},{"type":39,"tag":145,"props":2845,"children":2846},{},[2847],{"type":39,"tag":53,"props":2848,"children":2850},{"className":2849},[],[2851],{"type":44,"value":2852},"resource.attributes.k8s.pod.name",{"type":39,"tag":118,"props":2854,"children":2855},{},[2856,2861,2869],{"type":39,"tag":145,"props":2857,"children":2858},{},[2859],{"type":44,"value":2860},"Namespace",{"type":39,"tag":145,"props":2862,"children":2863},{},[2864],{"type":39,"tag":53,"props":2865,"children":2867},{"className":2866},[],[2868],{"type":44,"value":1934},{"type":39,"tag":145,"props":2870,"children":2871},{},[2872],{"type":39,"tag":53,"props":2873,"children":2875},{"className":2874},[],[2876],{"type":44,"value":2877},"resource.attributes.k8s.namespace.name",{"type":39,"tag":118,"props":2879,"children":2880},{},[2881,2886,2894],{"type":39,"tag":145,"props":2882,"children":2883},{},[2884],{"type":44,"value":2885},"Node name",{"type":39,"tag":145,"props":2887,"children":2888},{},[2889],{"type":39,"tag":53,"props":2890,"children":2892},{"className":2891},[],[2893],{"type":44,"value":1920},{"type":39,"tag":145,"props":2895,"children":2896},{},[2897],{"type":39,"tag":53,"props":2898,"children":2900},{"className":2899},[],[2901],{"type":44,"value":2902},"resource.attributes.k8s.node.name",{"type":39,"tag":118,"props":2904,"children":2905},{},[2906,2911,2920],{"type":39,"tag":145,"props":2907,"children":2908},{},[2909],{"type":44,"value":2910},"Cluster name",{"type":39,"tag":145,"props":2912,"children":2913},{},[2914],{"type":39,"tag":53,"props":2915,"children":2917},{"className":2916},[],[2918],{"type":44,"value":2919},"k8s.cluster.name",{"type":39,"tag":145,"props":2921,"children":2922},{},[2923],{"type":44,"value":2924},"(same)",{"type":39,"tag":47,"props":2926,"children":2927},{},[2928,2930,2935,2937,2942],{"type":44,"value":2929},"Both forms work on ",{"type":39,"tag":53,"props":2931,"children":2933},{"className":2932},[],[2934],{"type":44,"value":1904},{"type":44,"value":2936},". Prefer the unprefixed form — it's shorter and also works on counter-field queries via ",{"type":39,"tag":53,"props":2938,"children":2940},{"className":2939},[],[2941],{"type":44,"value":2217},{"type":44,"value":362},{"type":39,"tag":47,"props":2944,"children":2945},{},[2946],{"type":39,"tag":157,"props":2947,"children":2948},{},[2949],{"type":44,"value":2950},"Common recipes:",{"type":39,"tag":47,"props":2952,"children":2953},{},[2954],{"type":44,"value":2955},"Top pods by memory (last 5m, across all namespaces):",{"type":39,"tag":99,"props":2957,"children":2960},{"className":2958,"code":2959,"language":44},[102],"FROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes AND k8s.pod.memory.working_set IS NOT NULL\n| STATS avg_mem = AVG(k8s.pod.memory.working_set),\n max_mem = MAX(k8s.pod.memory.working_set)\n BY k8s.pod.name, k8s.namespace.name\n| SORT max_mem DESC\n| LIMIT 20\n",[2961],{"type":39,"tag":53,"props":2962,"children":2963},{"__ignoreMap":107},[2964],{"type":44,"value":2959},{"type":39,"tag":47,"props":2966,"children":2967},{},[2968],{"type":44,"value":2969},"Which pods are on a specific node:",{"type":39,"tag":99,"props":2971,"children":2974},{"className":2972,"code":2973,"language":44},[102],"FROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes\n AND k8s.node.name == \"\u003Cnode>\" AND k8s.pod.name IS NOT NULL\n| STATS last_seen = MAX(@timestamp) BY k8s.pod.name, k8s.namespace.name\n| SORT last_seen DESC\n",[2975],{"type":39,"tag":53,"props":2976,"children":2977},{"__ignoreMap":107},[2978],{"type":44,"value":2973},{"type":39,"tag":47,"props":2980,"children":2981},{},[2982,2984,2989,2991,2996],{"type":44,"value":2983},"Namespace-wide memory average (single scalar — works in ",{"type":39,"tag":53,"props":2985,"children":2987},{"className":2986},[],[2988],{"type":44,"value":73},{"type":44,"value":2990},"\u002F",{"type":39,"tag":53,"props":2992,"children":2994},{"className":2993},[],[2995],{"type":44,"value":221},{"type":44,"value":2997}," mode):",{"type":39,"tag":99,"props":2999,"children":3002},{"className":3000,"code":3001,"language":44},[102],"FROM metrics-kubeletstatsreceiver.otel*\n| WHERE k8s.namespace.name == \"oteldemo-esyox-default\"\n AND k8s.pod.memory.working_set IS NOT NULL\n| STATS v = AVG(k8s.pod.memory.working_set)\n",[3003],{"type":39,"tag":53,"props":3004,"children":3005},{"__ignoreMap":107},[3006],{"type":44,"value":3001},{"type":39,"tag":47,"props":3008,"children":3009},{},[3010],{"type":44,"value":3011},"Is this node under memory pressure (working-set vs available):",{"type":39,"tag":99,"props":3013,"children":3016},{"className":3014,"code":3015,"language":44},[102],"FROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes\n AND k8s.node.name == \"\u003Cnode>\" AND k8s.node.memory.working_set IS NOT NULL\n| STATS working_set = AVG(k8s.node.memory.working_set),\n available = AVG(k8s.node.memory.available)\n",[3017],{"type":39,"tag":53,"props":3018,"children":3019},{"__ignoreMap":107},[3020],{"type":44,"value":3015},{"type":39,"tag":47,"props":3022,"children":3023},{},[3024,3026,3032],{"type":44,"value":3025},"Pods above namespace memory average (requires ES 9.2+ ",{"type":39,"tag":53,"props":3027,"children":3029},{"className":3028},[],[3030],{"type":44,"value":3031},"INLINE STATS",{"type":44,"value":3033},"):",{"type":39,"tag":99,"props":3035,"children":3038},{"className":3036,"code":3037,"language":44},[102],"FROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes\n AND k8s.pod.memory.working_set IS NOT NULL\n AND k8s.namespace.name == \"\u003Cnamespace>\"\n| STATS pod_mem = AVG(k8s.pod.memory.working_set) BY k8s.pod.name\n| INLINE STATS ns_avg = AVG(pod_mem)\n| WHERE pod_mem > ns_avg\n| EVAL pct_above_avg = ROUND((pod_mem - ns_avg) * 100.0 \u002F ns_avg, 1)\n| SORT pod_mem DESC\n",[3039],{"type":39,"tag":53,"props":3040,"children":3041},{"__ignoreMap":107},[3042],{"type":44,"value":3037},{"type":39,"tag":47,"props":3044,"children":3045},{},[3046,3048,3053],{"type":44,"value":3047},"Use ",{"type":39,"tag":53,"props":3049,"children":3051},{"className":3050},[],[3052],{"type":44,"value":3031},{"type":44,"value":3054}," whenever the question involves comparing individual entities to a group aggregate\n(\"above average\", \"top X% of namespace memory\", \"pods consuming more than their share\"). Without it,\nthis requires two separate queries and client-side joining.",{"type":39,"tag":92,"props":3056,"children":3058},{"id":3057},"counter-fields-require-ts-rate",[3059,3061,3066,3067],{"type":44,"value":3060},"Counter fields — require ",{"type":39,"tag":53,"props":3062,"children":3064},{"className":3063},[],[3065],{"type":44,"value":2217},{"type":44,"value":2219},{"type":39,"tag":53,"props":3068,"children":3070},{"className":3069},[],[3071],{"type":44,"value":2225},{"type":39,"tag":298,"props":3073,"children":3074},{},[3075,3084,3260],{"type":39,"tag":47,"props":3076,"children":3077},{},[3078,3079],{"type":44,"value":2181},{"type":39,"tag":157,"props":3080,"children":3081},{},[3082],{"type":44,"value":3083},"MANDATORY PRE-QUERY CHECKLIST — run this before writing any ES|QL:",{"type":39,"tag":3085,"props":3086,"children":3087},"ol",{},[3088,3152,3218],{"type":39,"tag":332,"props":3089,"children":3090},{},[3091,3096,3098],{"type":39,"tag":157,"props":3092,"children":3093},{},[3094],{"type":44,"value":3095},"Is any field I'm querying in the counter fields table below?",{"type":44,"value":3097}," (network I\u002FO, network errors, uptime)\n",{"type":39,"tag":328,"props":3099,"children":3100},{},[3101,3140],{"type":39,"tag":332,"props":3102,"children":3103},{},[3104,3106,3124,3126,3131,3133,3138],{"type":44,"value":3105},"YES → ",{"type":39,"tag":157,"props":3107,"children":3108},{},[3109,3111,3116,3118,3123],{"type":44,"value":3110},"Stop. Use ",{"type":39,"tag":53,"props":3112,"children":3114},{"className":3113},[],[3115],{"type":44,"value":2217},{"type":44,"value":3117},", not ",{"type":39,"tag":53,"props":3119,"children":3121},{"className":3120},[],[3122],{"type":44,"value":2209},{"type":44,"value":362},{"type":44,"value":3125}," Do not write ",{"type":39,"tag":53,"props":3127,"children":3129},{"className":3128},[],[3130],{"type":44,"value":2209},{"type":44,"value":3132}," under any circumstances. Go to the ",{"type":39,"tag":53,"props":3134,"children":3136},{"className":3135},[],[3137],{"type":44,"value":2217},{"type":44,"value":3139}," pattern below.",{"type":39,"tag":332,"props":3141,"children":3142},{},[3143,3145,3150],{"type":44,"value":3144},"NO → ",{"type":39,"tag":53,"props":3146,"children":3148},{"className":3147},[],[3149],{"type":44,"value":2209},{"type":44,"value":3151}," is fine. Proceed normally.",{"type":39,"tag":332,"props":3153,"children":3154},{},[3155,3167],{"type":39,"tag":157,"props":3156,"children":3157},{},[3158,3160,3165],{"type":44,"value":3159},"Am I inside a ",{"type":39,"tag":53,"props":3161,"children":3163},{"className":3162},[],[3164],{"type":44,"value":2217},{"type":44,"value":3166}," query?",{"type":39,"tag":328,"props":3168,"children":3169},{},[3170,3189],{"type":39,"tag":332,"props":3171,"children":3172},{},[3173,3174,3180,3182,3188],{"type":44,"value":3047},{"type":39,"tag":53,"props":3175,"children":3177},{"className":3176},[],[3178],{"type":44,"value":3179},"TBUCKET(duration)",{"type":44,"value":3181}," for time bucketing — e.g. ",{"type":39,"tag":53,"props":3183,"children":3185},{"className":3184},[],[3186],{"type":44,"value":3187},"TBUCKET(1 hour)",{"type":44,"value":362},{"type":39,"tag":332,"props":3190,"children":3191},{},[3192,3203,3205,3210,3212,3217],{"type":39,"tag":157,"props":3193,"children":3194},{},[3195,3197],{"type":44,"value":3196},"Never use ",{"type":39,"tag":53,"props":3198,"children":3200},{"className":3199},[],[3201],{"type":44,"value":3202},"BUCKET(@timestamp, interval)",{"type":44,"value":3204}," — that is ",{"type":39,"tag":53,"props":3206,"children":3208},{"className":3207},[],[3209],{"type":44,"value":2209},{"type":44,"value":3211},"-query syntax and will fail with a parse error inside ",{"type":39,"tag":53,"props":3213,"children":3215},{"className":3214},[],[3216],{"type":44,"value":2217},{"type":44,"value":362},{"type":39,"tag":332,"props":3219,"children":3220},{},[3221,3226],{"type":39,"tag":157,"props":3222,"children":3223},{},[3224],{"type":44,"value":3225},"Am I aggregating across multiple pods\u002Fnodes?",{"type":39,"tag":328,"props":3227,"children":3228},{},[3229,3248],{"type":39,"tag":332,"props":3230,"children":3231},{},[3232,3234,3239,3241,3247],{"type":44,"value":3233},"YES → wrap ",{"type":39,"tag":53,"props":3235,"children":3237},{"className":3236},[],[3238],{"type":44,"value":2225},{"type":44,"value":3240}," in ",{"type":39,"tag":53,"props":3242,"children":3244},{"className":3243},[],[3245],{"type":44,"value":3246},"SUM()",{"type":44,"value":362},{"type":39,"tag":332,"props":3249,"children":3250},{},[3251,3253,3259],{"type":44,"value":3252},"NO (single entity) → wrap in ",{"type":39,"tag":53,"props":3254,"children":3256},{"className":3255},[],[3257],{"type":44,"value":3258},"AVG()",{"type":44,"value":362},{"type":39,"tag":47,"props":3261,"children":3262},{},[3263,3265,3270,3272,3278,3280,3285],{"type":44,"value":3264},"Skipping this checklist and defaulting to ",{"type":39,"tag":53,"props":3266,"children":3268},{"className":3267},[],[3269],{"type":44,"value":2209},{"type":44,"value":3271}," on a counter field is the single most common query mistake. The error it produces (",{"type":39,"tag":53,"props":3273,"children":3275},{"className":3274},[],[3276],{"type":44,"value":3277},"argument of [...] must be [...numeric except counter types]",{"type":44,"value":3279},") is not recoverable by changing the aggregation function — the source command must be ",{"type":39,"tag":53,"props":3281,"children":3283},{"className":3282},[],[3284],{"type":44,"value":2217},{"type":44,"value":362},{"type":39,"tag":47,"props":3287,"children":3288},{},[3289,3291,3296,3298,3303,3305,3310,3311,3316,3317,3322,3323,3328,3329,3335,3337,3342],{"type":44,"value":3290},"Network I\u002FO, network errors, and uptime fields are stored as monotonically-increasing counters\n(",{"type":39,"tag":53,"props":3292,"children":3294},{"className":3293},[],[3295],{"type":44,"value":2197},{"type":44,"value":3297},"), ",{"type":39,"tag":157,"props":3299,"children":3300},{},[3301],{"type":44,"value":3302},"not",{"type":44,"value":3304}," instantaneous gauges. ",{"type":39,"tag":53,"props":3306,"children":3308},{"className":3307},[],[3309],{"type":44,"value":2209},{"type":44,"value":2219},{"type":39,"tag":53,"props":3312,"children":3314},{"className":3313},[],[3315],{"type":44,"value":2255},{"type":44,"value":2990},{"type":39,"tag":53,"props":3318,"children":3320},{"className":3319},[],[3321],{"type":44,"value":2247},{"type":44,"value":2990},{"type":39,"tag":53,"props":3324,"children":3326},{"className":3325},[],[3327],{"type":44,"value":2262},{"type":44,"value":2990},{"type":39,"tag":53,"props":3330,"children":3332},{"className":3331},[],[3333],{"type":44,"value":3334},"VALUES",{"type":44,"value":3336}," on a counter\nfield is a hard error — ES|QL returns ",{"type":39,"tag":53,"props":3338,"children":3340},{"className":3339},[],[3341],{"type":44,"value":3277},{"type":44,"value":362},{"type":39,"tag":298,"props":3344,"children":3345},{},[3346],{"type":39,"tag":47,"props":3347,"children":3348},{},[3349,3354,3355,3360,3361,3366,3368,3374,3376,3381,3383,3388,3390,3396],{"type":39,"tag":157,"props":3350,"children":3351},{},[3352],{"type":44,"value":3353},"Version requirement:",{"type":44,"value":2115},{"type":39,"tag":53,"props":3356,"children":3358},{"className":3357},[],[3359],{"type":44,"value":2217},{"type":44,"value":949},{"type":39,"tag":53,"props":3362,"children":3364},{"className":3363},[],[3365],{"type":44,"value":2225},{"type":44,"value":3367},", and ",{"type":39,"tag":53,"props":3369,"children":3371},{"className":3370},[],[3372],{"type":44,"value":3373},"TBUCKET()",{"type":44,"value":3375}," require Elasticsearch ",{"type":39,"tag":157,"props":3377,"children":3378},{},[3379],{"type":44,"value":3380},"9.2+",{"type":44,"value":3382},". On older\nclusters, ",{"type":39,"tag":53,"props":3384,"children":3386},{"className":3385},[],[3387],{"type":44,"value":2197},{"type":44,"value":3389}," fields cannot be aggregated at all — there is no workaround. If ",{"type":39,"tag":53,"props":3391,"children":3393},{"className":3392},[],[3394],{"type":44,"value":3395},"TS \u003Cindex>",{"type":44,"value":3397},"\nreturns a parse error, verify the cluster version before iterating on syntax.",{"type":39,"tag":47,"props":3399,"children":3400},{},[3401],{"type":44,"value":3402},"Counter fields in this deployment:",{"type":39,"tag":81,"props":3404,"children":3405},{},[3406,3421],{"type":39,"tag":114,"props":3407,"children":3408},{},[3409],{"type":39,"tag":118,"props":3410,"children":3411},{},[3412,3416],{"type":39,"tag":122,"props":3413,"children":3414},{},[3415],{"type":44,"value":2359},{"type":39,"tag":122,"props":3417,"children":3418},{},[3419],{"type":44,"value":3420},"Notes",{"type":39,"tag":138,"props":3422,"children":3423},{},[3424,3464,3486,3510],{"type":39,"tag":118,"props":3425,"children":3426},{},[3427,3436],{"type":39,"tag":145,"props":3428,"children":3429},{},[3430],{"type":39,"tag":53,"props":3431,"children":3433},{"className":3432},[],[3434],{"type":44,"value":3435},"k8s.pod.network.io",{"type":39,"tag":145,"props":3437,"children":3438},{},[3439,3441,3447,3449,3455,3456,3462],{"type":44,"value":3440},"bytes, carries ",{"type":39,"tag":53,"props":3442,"children":3444},{"className":3443},[],[3445],{"type":44,"value":3446},"direction",{"type":44,"value":3448}," attribute (",{"type":39,"tag":53,"props":3450,"children":3452},{"className":3451},[],[3453],{"type":44,"value":3454},"transmit",{"type":44,"value":75},{"type":39,"tag":53,"props":3457,"children":3459},{"className":3458},[],[3460],{"type":44,"value":3461},"receive",{"type":44,"value":3463},") — emitted as separate docs per direction",{"type":39,"tag":118,"props":3465,"children":3466},{},[3467,3476],{"type":39,"tag":145,"props":3468,"children":3469},{},[3470],{"type":39,"tag":53,"props":3471,"children":3473},{"className":3472},[],[3474],{"type":44,"value":3475},"k8s.pod.network.errors",{"type":39,"tag":145,"props":3477,"children":3478},{},[3479,3481],{"type":44,"value":3480},"error count, also carries ",{"type":39,"tag":53,"props":3482,"children":3484},{"className":3483},[],[3485],{"type":44,"value":3446},{"type":39,"tag":118,"props":3487,"children":3488},{},[3489,3505],{"type":39,"tag":145,"props":3490,"children":3491},{},[3492,3498,3499],{"type":39,"tag":53,"props":3493,"children":3495},{"className":3494},[],[3496],{"type":44,"value":3497},"k8s.node.network.io",{"type":44,"value":949},{"type":39,"tag":53,"props":3500,"children":3502},{"className":3501},[],[3503],{"type":44,"value":3504},"k8s.node.network.errors",{"type":39,"tag":145,"props":3506,"children":3507},{},[3508],{"type":44,"value":3509},"node-level equivalents",{"type":39,"tag":118,"props":3511,"children":3512},{},[3513,3529],{"type":39,"tag":145,"props":3514,"children":3515},{},[3516,3522,3523],{"type":39,"tag":53,"props":3517,"children":3519},{"className":3518},[],[3520],{"type":44,"value":3521},"k8s.node.uptime",{"type":44,"value":949},{"type":39,"tag":53,"props":3524,"children":3526},{"className":3525},[],[3527],{"type":44,"value":3528},"k8s.pod.uptime",{"type":39,"tag":145,"props":3530,"children":3531},{},[3532],{"type":44,"value":3533},"seconds since start",{"type":39,"tag":47,"props":3535,"children":3536},{},[3537,3542,3543,3548,3550,3555,3557,3562,3563,3568,3570,3576,3577,3583],{"type":39,"tag":157,"props":3538,"children":3539},{},[3540],{"type":44,"value":3541},"Correct pattern:",{"type":44,"value":2115},{"type":39,"tag":53,"props":3544,"children":3546},{"className":3545},[],[3547],{"type":44,"value":2217},{"type":44,"value":3549}," as the ",{"type":39,"tag":157,"props":3551,"children":3552},{},[3553],{"type":44,"value":3554},"source command",{"type":44,"value":3556}," (replaces ",{"type":39,"tag":53,"props":3558,"children":3560},{"className":3559},[],[3561],{"type":44,"value":2209},{"type":44,"value":3297},{"type":39,"tag":53,"props":3564,"children":3566},{"className":3565},[],[3567],{"type":44,"value":2225},{"type":44,"value":3569}," wrapped in an outer\naggregation, counter field filtered ",{"type":39,"tag":53,"props":3571,"children":3573},{"className":3572},[],[3574],{"type":44,"value":3575},"IS NOT NULL",{"type":44,"value":3367},{"type":39,"tag":53,"props":3578,"children":3580},{"className":3579},[],[3581],{"type":44,"value":3582},"BY direction",{"type":44,"value":3584}," whenever querying network fields.",{"type":39,"tag":99,"props":3586,"children":3589},{"className":3587,"code":3588,"language":44},[102],"\u002F\u002F CORRECT — TS as source, SUM(RATE()) for cluster-wide total, BUCKET(@timestamp, interval) for time bucketing\n\u002F\u002F Always alias the BUCKET expression and SORT by the alias — SORT on the raw BUCKET(...) expression fails\nTS metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 15 minutes\n AND k8s.node.network.io IS NOT NULL\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY bucket = BUCKET(@timestamp, 1 minute), direction\n| SORT bucket ASC\n\n\u002F\u002F WRONG — FROM is rejected for counter_long fields\nFROM metrics-kubeletstatsreceiver.otel*\n| STATS max_io = MAX(k8s.node.network.io) ... ← hard error\n\n\u002F\u002F WRONG — sorting on the raw BUCKET expression (not the alias) fails in TS context\nTS metrics-kubeletstatsreceiver.otel*\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY bucket = BUCKET(@timestamp, 1 minute), direction\n| SORT BUCKET(@timestamp, 1 minute) ASC ← parse error; use alias instead\n",[3590],{"type":39,"tag":53,"props":3591,"children":3592},{"__ignoreMap":107},[3593],{"type":44,"value":3588},{"type":39,"tag":47,"props":3595,"children":3596},{},[3597,3620,3622,3628,3630,3636,3638,3643,3645,3650],{"type":39,"tag":157,"props":3598,"children":3599},{},[3600,3605,3607,3612,3614,3619],{"type":39,"tag":53,"props":3601,"children":3603},{"className":3602},[],[3604],{"type":44,"value":2262},{"type":44,"value":3606}," vs ",{"type":39,"tag":53,"props":3608,"children":3610},{"className":3609},[],[3611],{"type":44,"value":2247},{"type":44,"value":3613}," when wrapping ",{"type":39,"tag":53,"props":3615,"children":3617},{"className":3616},[],[3618],{"type":44,"value":2225},{"type":44,"value":326},{"type":44,"value":3621}," Use ",{"type":39,"tag":53,"props":3623,"children":3625},{"className":3624},[],[3626],{"type":44,"value":3627},"SUM(RATE(...))",{"type":44,"value":3629}," when aggregating across multiple\nparallel time series (e.g. total cluster throughput across all nodes). Use ",{"type":39,"tag":53,"props":3631,"children":3633},{"className":3632},[],[3634],{"type":44,"value":3635},"AVG(RATE(...))",{"type":44,"value":3637}," when you\nwant the mean rate per entity (e.g. average per-pod transmit rate). Mixing them up produces silently\nwrong numbers — ",{"type":39,"tag":53,"props":3639,"children":3641},{"className":3640},[],[3642],{"type":44,"value":2247},{"type":44,"value":3644}," of a cluster-wide roll-up understates throughput; ",{"type":39,"tag":53,"props":3646,"children":3648},{"className":3647},[],[3649],{"type":44,"value":2262},{"type":44,"value":3651}," of a single-entity\nquery overstates it.",{"type":39,"tag":47,"props":3653,"children":3654},{},[3655,3667,3668,3673,3675,3680,3682,3688,3690,3695,3697,3703,3705,3710,3712,3718,3720,3724],{"type":39,"tag":157,"props":3656,"children":3657},{},[3658,3660,3665],{"type":44,"value":3659},"Time bucketing in ",{"type":39,"tag":53,"props":3661,"children":3663},{"className":3662},[],[3664],{"type":44,"value":2217},{"type":44,"value":3666}," queries:",{"type":44,"value":3621},{"type":39,"tag":53,"props":3669,"children":3671},{"className":3670},[],[3672],{"type":44,"value":3202},{"type":44,"value":3674}," — the same syntax as ",{"type":39,"tag":53,"props":3676,"children":3678},{"className":3677},[],[3679],{"type":44,"value":2209},{"type":44,"value":3681},"\nqueries. Always assign it an alias (e.g. ",{"type":39,"tag":53,"props":3683,"children":3685},{"className":3684},[],[3686],{"type":44,"value":3687},"BY bucket = BUCKET(@timestamp, 1 hour)",{"type":44,"value":3689},") and reference\nthat alias in any subsequent ",{"type":39,"tag":53,"props":3691,"children":3693},{"className":3692},[],[3694],{"type":44,"value":1831},{"type":44,"value":3696}," — sorting on the raw ",{"type":39,"tag":53,"props":3698,"children":3700},{"className":3699},[],[3701],{"type":44,"value":3702},"BUCKET(@timestamp, ...)",{"type":44,"value":3704}," expression is\nrejected in ",{"type":39,"tag":53,"props":3706,"children":3708},{"className":3707},[],[3709],{"type":44,"value":2217},{"type":44,"value":3711}," context. ",{"type":39,"tag":53,"props":3713,"children":3715},{"className":3714},[],[3716],{"type":44,"value":3717},"TBUCKET",{"type":44,"value":3719}," (duration-only form) does ",{"type":39,"tag":157,"props":3721,"children":3722},{},[3723],{"type":44,"value":3302},{"type":44,"value":3725}," work reliably on this\ndeployment and should not be used.",{"type":39,"tag":99,"props":3727,"children":3730},{"className":3728,"code":3729,"language":44},[102],"\u002F\u002F CORRECT — aliased BUCKET, sorted by alias\nTS metrics-kubeletstatsreceiver.otel*\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY bucket = BUCKET(@timestamp, 1 hour), direction\n| SORT bucket ASC\n\n\u002F\u002F WRONG — TBUCKET is unreliable; fails with \"@timestamp not found\" on this deployment\nTS metrics-kubeletstatsreceiver.otel*\n| STATS total_bps = SUM(RATE(k8s.node.network.io))\n BY TBUCKET(1 hour), direction ← verification_exception on @timestamp\n\n\u002F\u002F WRONG — passing @timestamp to TBUCKET is also rejected\n| STATS ... BY TBUCKET(@timestamp, 1 hour) ← argument type error\n",[3731],{"type":39,"tag":53,"props":3732,"children":3733},{"__ignoreMap":107},[3734],{"type":44,"value":3729},{"type":39,"tag":47,"props":3736,"children":3737},{},[3738],{"type":44,"value":3739},"Rules:",{"type":39,"tag":328,"props":3741,"children":3742},{},[3743,3774,3807,3834,3846],{"type":39,"tag":332,"props":3744,"children":3745},{},[3746,3751,3752,3758,3760,3765,3767,3772],{"type":39,"tag":53,"props":3747,"children":3749},{"className":3748},[],[3750],{"type":44,"value":3395},{"type":44,"value":3117},{"type":39,"tag":53,"props":3753,"children":3755},{"className":3754},[],[3756],{"type":44,"value":3757},"FROM \u003Cindex>",{"type":44,"value":3759},". ",{"type":39,"tag":53,"props":3761,"children":3763},{"className":3762},[],[3764],{"type":44,"value":2209},{"type":44,"value":3766}," will be rejected for ",{"type":39,"tag":53,"props":3768,"children":3770},{"className":3769},[],[3771],{"type":44,"value":2197},{"type":44,"value":3773}," fields.",{"type":39,"tag":332,"props":3775,"children":3776},{},[3777,3779,3784,3785,3790,3792,3797,3799,3805],{"type":44,"value":3778},"Wrap ",{"type":39,"tag":53,"props":3780,"children":3782},{"className":3781},[],[3783],{"type":44,"value":2225},{"type":44,"value":3240},{"type":39,"tag":53,"props":3786,"children":3788},{"className":3787},[],[3789],{"type":44,"value":3246},{"type":44,"value":3791}," for totals across entities, ",{"type":39,"tag":53,"props":3793,"children":3795},{"className":3794},[],[3796],{"type":44,"value":3258},{"type":44,"value":3798}," for per-entity averages — bare ",{"type":39,"tag":53,"props":3800,"children":3802},{"className":3801},[],[3803],{"type":44,"value":3804},"RATE(...) BY ...",{"type":44,"value":3806}," is rejected.",{"type":39,"tag":332,"props":3808,"children":3809},{},[3810,3812,3817,3819,3824,3826,3832],{"type":44,"value":3811},"Network counters are emitted as ",{"type":39,"tag":157,"props":3813,"children":3814},{},[3815],{"type":44,"value":3816},"separate docs per direction",{"type":44,"value":3818},". Without ",{"type":39,"tag":53,"props":3820,"children":3822},{"className":3821},[],[3823],{"type":44,"value":3582},{"type":44,"value":3825}," or a ",{"type":39,"tag":53,"props":3827,"children":3829},{"className":3828},[],[3830],{"type":44,"value":3831},"direction == \"...\"",{"type":44,"value":3833}," filter, transmit and receive aggregate into a meaningless combined number.",{"type":39,"tag":332,"props":3835,"children":3836},{},[3837,3839,3844],{"type":44,"value":3838},"Without ",{"type":39,"tag":53,"props":3840,"children":3842},{"className":3841},[],[3843],{"type":44,"value":3575},{"type":44,"value":3845}," the query spans many kubeletstats docs that carry a different metric — you get nulls, not errors.",{"type":39,"tag":332,"props":3847,"children":3848},{},[3849,3850,3855,3857,3862,3864,3868,3870,3875],{"type":44,"value":3047},{"type":39,"tag":53,"props":3851,"children":3853},{"className":3852},[],[3854],{"type":44,"value":3202},{"type":44,"value":3856}," for time bucketing inside ",{"type":39,"tag":53,"props":3858,"children":3860},{"className":3859},[],[3861],{"type":44,"value":2217},{"type":44,"value":3863}," queries, always aliased. Do ",{"type":39,"tag":157,"props":3865,"children":3866},{},[3867],{"type":44,"value":3302},{"type":44,"value":3869}," use ",{"type":39,"tag":53,"props":3871,"children":3873},{"className":3872},[],[3874],{"type":44,"value":3717},{"type":44,"value":362},{"type":39,"tag":47,"props":3877,"children":3878},{},[3879,3884,3886,3892],{"type":39,"tag":157,"props":3880,"children":3881},{},[3882],{"type":44,"value":3883},"Escape hatch — raw counter snapshot:",{"type":44,"value":3885}," if you want the current counter value (e.g. \"how long has\nnode X been up\"), cast first. ",{"type":39,"tag":53,"props":3887,"children":3889},{"className":3888},[],[3890],{"type":44,"value":3891},"TO_LONG",{"type":44,"value":3893}," strips the counter type and unlocks standard aggregations:",{"type":39,"tag":99,"props":3895,"children":3898},{"className":3896,"code":3897,"language":44},[102],"FROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 5 minutes AND k8s.node.uptime IS NOT NULL\n| EVAL u = TO_LONG(k8s.node.uptime)\n| STATS uptime_s = MAX(u) BY k8s.node.name\n",[3899],{"type":39,"tag":53,"props":3900,"children":3901},{"__ignoreMap":107},[3902],{"type":44,"value":3897},{"type":39,"tag":92,"props":3904,"children":3906},{"id":3905},"apm-traces",[3907],{"type":44,"value":3908},"APM traces",{"type":39,"tag":47,"props":3910,"children":3911},{},[3912,3914,3919,3921,3926],{"type":44,"value":3913},"Primary index: ",{"type":39,"tag":53,"props":3915,"children":3917},{"className":3916},[],[3918],{"type":44,"value":1960},{"type":44,"value":3920}," (OTel-native). Fallback: ",{"type":39,"tag":53,"props":3922,"children":3924},{"className":3923},[],[3925],{"type":44,"value":1967},{"type":44,"value":3927}," (classic APM — only if the OTel path returns empty).",{"type":39,"tag":47,"props":3929,"children":3930},{},[3931,3933,3938,3940,3944,3946,3952,3953,3959,3960,3966,3968,3974,3975,3980,3981,3986],{"type":44,"value":3932},"In EDOT-ingested clusters, ",{"type":39,"tag":53,"props":3934,"children":3936},{"className":3935},[],[3937],{"type":44,"value":1960},{"type":44,"value":3939}," carries ",{"type":39,"tag":157,"props":3941,"children":3942},{},[3943],{"type":44,"value":2099},{"type":44,"value":3945}," OTel-native fields (",{"type":39,"tag":53,"props":3947,"children":3949},{"className":3948},[],[3950],{"type":44,"value":3951},"duration",{"type":44,"value":949},{"type":39,"tag":53,"props":3954,"children":3956},{"className":3955},[],[3957],{"type":44,"value":3958},"kind",{"type":44,"value":949},{"type":39,"tag":53,"props":3961,"children":3963},{"className":3962},[],[3964],{"type":44,"value":3965},"status.code",{"type":44,"value":3967},") and classic-APM-compatible fields (",{"type":39,"tag":53,"props":3969,"children":3971},{"className":3970},[],[3972],{"type":44,"value":3973},"processor.event",{"type":44,"value":949},{"type":39,"tag":53,"props":3976,"children":3978},{"className":3977},[],[3979],{"type":44,"value":1989},{"type":44,"value":949},{"type":39,"tag":53,"props":3982,"children":3984},{"className":3983},[],[3985],{"type":44,"value":1982},{"type":44,"value":3987}," on transaction-level docs). The cluster's \"APM-ness\" isn't determined by the index — it's determined by which field shape you query.",{"type":39,"tag":81,"props":3989,"children":3990},{},[3991,4011],{"type":39,"tag":114,"props":3992,"children":3993},{},[3994],{"type":39,"tag":118,"props":3995,"children":3996},{},[3997,4001,4006],{"type":39,"tag":122,"props":3998,"children":3999},{},[4000],{"type":44,"value":2354},{"type":39,"tag":122,"props":4002,"children":4003},{},[4004],{"type":44,"value":4005},"OTel-native (preferred)",{"type":39,"tag":122,"props":4007,"children":4008},{},[4009],{"type":44,"value":4010},"Classic APM",{"type":39,"tag":138,"props":4012,"children":4013},{},[4014,4050,4095,4149,4232,4259],{"type":39,"tag":118,"props":4015,"children":4016},{},[4017,4022,4032],{"type":39,"tag":145,"props":4018,"children":4019},{},[4020],{"type":44,"value":4021},"Duration",{"type":39,"tag":145,"props":4023,"children":4024},{},[4025,4030],{"type":39,"tag":53,"props":4026,"children":4028},{"className":4027},[],[4029],{"type":44,"value":3951},{"type":44,"value":4031}," (nanoseconds, long, populated on every span)",{"type":39,"tag":145,"props":4033,"children":4034},{},[4035,4040,4042,4048],{"type":39,"tag":53,"props":4036,"children":4038},{"className":4037},[],[4039],{"type":44,"value":1982},{"type":44,"value":4041}," (microseconds, populated only on ",{"type":39,"tag":53,"props":4043,"children":4045},{"className":4044},[],[4046],{"type":44,"value":4047},"processor.event == \"transaction\"",{"type":44,"value":4049}," docs)",{"type":39,"tag":118,"props":4051,"children":4052},{},[4053,4058,4076],{"type":39,"tag":145,"props":4054,"children":4055},{},[4056],{"type":44,"value":4057},"Error signal",{"type":39,"tag":145,"props":4059,"children":4060},{},[4061,4067,4069,4074],{"type":39,"tag":53,"props":4062,"children":4064},{"className":4063},[],[4065],{"type":44,"value":4066},"event.outcome == \"failure\"",{"type":44,"value":4068}," — ",{"type":39,"tag":157,"props":4070,"children":4071},{},[4072],{"type":44,"value":4073},"use this",{"type":44,"value":4075},", 100% populated",{"type":39,"tag":145,"props":4077,"children":4078},{},[4079,4085,4087,4093],{"type":39,"tag":53,"props":4080,"children":4082},{"className":4081},[],[4083],{"type":44,"value":4084},"status.code == \"Error\"",{"type":44,"value":4086}," (sparse; only set when instrumentation explicitly calls ",{"type":39,"tag":53,"props":4088,"children":4090},{"className":4089},[],[4091],{"type":44,"value":4092},"SetStatus",{"type":44,"value":4094},")",{"type":39,"tag":118,"props":4096,"children":4097},{},[4098,4103,4126],{"type":39,"tag":145,"props":4099,"children":4100},{},[4101],{"type":44,"value":4102},"Error message \u002F type \u002F stacktrace",{"type":39,"tag":145,"props":4104,"children":4105},{},[4106,4112,4113,4119,4120],{"type":39,"tag":53,"props":4107,"children":4109},{"className":4108},[],[4110],{"type":44,"value":4111},"exception.message",{"type":44,"value":949},{"type":39,"tag":53,"props":4114,"children":4116},{"className":4115},[],[4117],{"type":44,"value":4118},"exception.type",{"type":44,"value":949},{"type":39,"tag":53,"props":4121,"children":4123},{"className":4122},[],[4124],{"type":44,"value":4125},"exception.stacktrace",{"type":39,"tag":145,"props":4127,"children":4128},{},[4129,4135,4136,4142,4143],{"type":39,"tag":53,"props":4130,"children":4132},{"className":4131},[],[4133],{"type":44,"value":4134},"error.message",{"type":44,"value":949},{"type":39,"tag":53,"props":4137,"children":4139},{"className":4138},[],[4140],{"type":44,"value":4141},"error.exception.type",{"type":44,"value":949},{"type":39,"tag":53,"props":4144,"children":4146},{"className":4145},[],[4147],{"type":44,"value":4148},"error.stack_trace",{"type":39,"tag":118,"props":4150,"children":4151},{},[4152,4157,4223],{"type":39,"tag":145,"props":4153,"children":4154},{},[4155],{"type":44,"value":4156},"Span kind",{"type":39,"tag":145,"props":4158,"children":4159},{},[4160,4165,4167,4173,4174,4180,4181,4187,4188,4194,4195,4201,4203,4208,4209,4215,4216,4222],{"type":39,"tag":53,"props":4161,"children":4163},{"className":4162},[],[4164],{"type":44,"value":3958},{"type":44,"value":4166}," — values ",{"type":39,"tag":53,"props":4168,"children":4170},{"className":4169},[],[4171],{"type":44,"value":4172},"Server",{"type":44,"value":949},{"type":39,"tag":53,"props":4175,"children":4177},{"className":4176},[],[4178],{"type":44,"value":4179},"Internal",{"type":44,"value":949},{"type":39,"tag":53,"props":4182,"children":4184},{"className":4183},[],[4185],{"type":44,"value":4186},"Client",{"type":44,"value":949},{"type":39,"tag":53,"props":4189,"children":4191},{"className":4190},[],[4192],{"type":44,"value":4193},"Producer",{"type":44,"value":949},{"type":39,"tag":53,"props":4196,"children":4198},{"className":4197},[],[4199],{"type":44,"value":4200},"Consumer",{"type":44,"value":4202}," (",{"type":39,"tag":157,"props":4204,"children":4205},{},[4206],{"type":44,"value":4207},"title case",{"type":44,"value":3117},{"type":39,"tag":53,"props":4210,"children":4212},{"className":4211},[],[4213],{"type":44,"value":4214},"SERVER",{"type":44,"value":2990},{"type":39,"tag":53,"props":4217,"children":4219},{"className":4218},[],[4220],{"type":44,"value":4221},"CLIENT",{"type":44,"value":4094},{"type":39,"tag":145,"props":4224,"children":4225},{},[4226],{"type":39,"tag":53,"props":4227,"children":4229},{"className":4228},[],[4230],{"type":44,"value":4231},"transaction.type",{"type":39,"tag":118,"props":4233,"children":4234},{},[4235,4240,4251],{"type":39,"tag":145,"props":4236,"children":4237},{},[4238],{"type":44,"value":4239},"Scope filter",{"type":39,"tag":145,"props":4241,"children":4242},{},[4243,4249],{"type":39,"tag":53,"props":4244,"children":4246},{"className":4245},[],[4247],{"type":44,"value":4248},"kind == \"Server\"",{"type":44,"value":4250}," isolates incoming requests",{"type":39,"tag":145,"props":4252,"children":4253},{},[4254],{"type":39,"tag":53,"props":4255,"children":4257},{"className":4256},[],[4258],{"type":44,"value":4047},{"type":39,"tag":118,"props":4260,"children":4261},{},[4262,4267,4275],{"type":39,"tag":145,"props":4263,"children":4264},{},[4265],{"type":44,"value":4266},"Service name",{"type":39,"tag":145,"props":4268,"children":4269},{},[4270],{"type":39,"tag":53,"props":4271,"children":4273},{"className":4272},[],[4274],{"type":44,"value":1941},{"type":39,"tag":145,"props":4276,"children":4277},{},[4278],{"type":39,"tag":53,"props":4279,"children":4281},{"className":4280},[],[4282],{"type":44,"value":1941},{"type":39,"tag":298,"props":4284,"children":4285},{},[4286],{"type":39,"tag":47,"props":4287,"children":4288},{},[4289,4294,4296,4301,4303,4308,4310,4315,4316,4321],{"type":39,"tag":157,"props":4290,"children":4291},{},[4292],{"type":44,"value":4293},"Unit warning.",{"type":44,"value":4295}," OTel ",{"type":39,"tag":53,"props":4297,"children":4299},{"className":4298},[],[4300],{"type":44,"value":3951},{"type":44,"value":4302}," is in ",{"type":39,"tag":157,"props":4304,"children":4305},{},[4306],{"type":44,"value":4307},"nanoseconds",{"type":44,"value":4309},". Divide by 1,000,000 for milliseconds. Classic ",{"type":39,"tag":53,"props":4311,"children":4313},{"className":4312},[],[4314],{"type":44,"value":1982},{"type":44,"value":4302},{"type":39,"tag":157,"props":4317,"children":4318},{},[4319],{"type":44,"value":4320},"microseconds",{"type":44,"value":4322}," — divide by 1,000. Mixing these across a comparison produces wildly wrong numbers.",{"type":39,"tag":298,"props":4324,"children":4325},{},[4326],{"type":39,"tag":47,"props":4327,"children":4328},{},[4329,4334,4336,4341,4343,4349,4351,4355,4356,4362,4364,4369,4370,4376,4378,4384,4386,4391,4393,4398,4400,4405],{"type":39,"tag":157,"props":4330,"children":4331},{},[4332],{"type":44,"value":4333},"Error-field warning.",{"type":44,"value":4335}," On ",{"type":39,"tag":53,"props":4337,"children":4339},{"className":4338},[],[4340],{"type":44,"value":1960},{"type":44,"value":4342}," the exception attributes use the ",{"type":39,"tag":53,"props":4344,"children":4346},{"className":4345},[],[4347],{"type":44,"value":4348},"exception.*",{"type":44,"value":4350}," namespace, ",{"type":39,"tag":157,"props":4352,"children":4353},{},[4354],{"type":44,"value":3302},{"type":44,"value":2115},{"type":39,"tag":53,"props":4357,"children":4359},{"className":4358},[],[4360],{"type":44,"value":4361},"error.*",{"type":44,"value":4363},". Querying ",{"type":39,"tag":53,"props":4365,"children":4367},{"className":4366},[],[4368],{"type":44,"value":4134},{"type":44,"value":75},{"type":39,"tag":53,"props":4371,"children":4373},{"className":4372},[],[4374],{"type":44,"value":4375},"error.type",{"type":44,"value":4377}," against an OTel-native index returns ",{"type":39,"tag":53,"props":4379,"children":4381},{"className":4380},[],[4382],{"type":44,"value":4383},"verification_exception: Unknown column [error.message], did you mean any of [exception.message, message]?",{"type":44,"value":4385},". The ",{"type":39,"tag":53,"props":4387,"children":4389},{"className":4388},[],[4390],{"type":44,"value":4361},{"type":44,"value":4392}," family belongs only to classic-APM ",{"type":39,"tag":53,"props":4394,"children":4396},{"className":4395},[],[4397],{"type":44,"value":1967},{"type":44,"value":4399}," documents. When you see the user ask \"show me the error messages from X\", reach for ",{"type":39,"tag":53,"props":4401,"children":4403},{"className":4402},[],[4404],{"type":44,"value":4111},{"type":44,"value":4406}," first.",{"type":39,"tag":298,"props":4408,"children":4409},{},[4410,4427,4581],{"type":39,"tag":47,"props":4411,"children":4412},{},[4413,4418,4420,4425],{"type":39,"tag":157,"props":4414,"children":4415},{},[4416],{"type":44,"value":4417},"Where exception data actually lives — three deployment shapes.",{"type":44,"value":4419}," OTel records exceptions as Span Events; ",{"type":39,"tag":2117,"props":4421,"children":4422},{},[4423],{"type":44,"value":4424},"where they end up indexed",{"type":44,"value":4426}," depends on the exporter pipeline:",{"type":39,"tag":3085,"props":4428,"children":4429},{},[4430,4465,4538],{"type":39,"tag":332,"props":4431,"children":4432},{},[4433,4438,4440,4445,4446,4451,4452,4457,4459,4464],{"type":39,"tag":157,"props":4434,"children":4435},{},[4436],{"type":44,"value":4437},"Flattened onto the trace doc",{"type":44,"value":4439}," — the parent span carries ",{"type":39,"tag":53,"props":4441,"children":4443},{"className":4442},[],[4444],{"type":44,"value":4111},{"type":44,"value":949},{"type":39,"tag":53,"props":4447,"children":4449},{"className":4448},[],[4450],{"type":44,"value":4118},{"type":44,"value":949},{"type":39,"tag":53,"props":4453,"children":4455},{"className":4454},[],[4456],{"type":44,"value":4125},{"type":44,"value":4458},". Common with EDOT + APM Server. Query ",{"type":39,"tag":53,"props":4460,"children":4462},{"className":4461},[],[4463],{"type":44,"value":1960},{"type":44,"value":362},{"type":39,"tag":332,"props":4466,"children":4467},{},[4468,4473,4474,4480,4481,4486,4487,4492,4494,4500,4502,4508,4510,4515,4517,4523,4524,4529,4530,4536],{"type":39,"tag":157,"props":4469,"children":4470},{},[4471],{"type":44,"value":4472},"Exported as separate log records",{"type":44,"value":4068},{"type":39,"tag":53,"props":4475,"children":4477},{"className":4476},[],[4478],{"type":44,"value":4479},"logs-*.otel-*",{"type":44,"value":3939},{"type":39,"tag":53,"props":4482,"children":4484},{"className":4483},[],[4485],{"type":44,"value":4111},{"type":44,"value":75},{"type":39,"tag":53,"props":4488,"children":4490},{"className":4489},[],[4491],{"type":44,"value":4118},{"type":44,"value":4493},", correlated to the trace via ",{"type":39,"tag":53,"props":4495,"children":4497},{"className":4496},[],[4498],{"type":44,"value":4499},"trace.id",{"type":44,"value":4501}," and ",{"type":39,"tag":53,"props":4503,"children":4505},{"className":4504},[],[4506],{"type":44,"value":4507},"span.id",{"type":44,"value":4509},". This is the ",{"type":39,"tag":2117,"props":4511,"children":4512},{},[4513],{"type":44,"value":4514},"default",{"type":44,"value":4516}," OpenTelemetry Collector pipeline. The trace doc itself only carries ",{"type":39,"tag":53,"props":4518,"children":4520},{"className":4519},[],[4521],{"type":44,"value":4522},"status.message",{"type":44,"value":75},{"type":39,"tag":53,"props":4525,"children":4527},{"className":4526},[],[4528],{"type":44,"value":3965},{"type":44,"value":4202},{"type":39,"tag":53,"props":4531,"children":4533},{"className":4532},[],[4534],{"type":44,"value":4535},"Error",{"type":44,"value":4537}," on failed spans).",{"type":39,"tag":332,"props":4539,"children":4540},{},[4541,4554,4555,4560,4561,4567,4568,4573,4574,4579],{"type":39,"tag":157,"props":4542,"children":4543},{},[4544,4546,4552],{"type":44,"value":4545},"Classic APM ",{"type":39,"tag":53,"props":4547,"children":4549},{"className":4548},[],[4550],{"type":44,"value":4551},"error",{"type":44,"value":4553}," events",{"type":44,"value":4068},{"type":39,"tag":53,"props":4556,"children":4558},{"className":4557},[],[4559],{"type":44,"value":1967},{"type":44,"value":1666},{"type":39,"tag":53,"props":4562,"children":4564},{"className":4563},[],[4565],{"type":44,"value":4566},"processor.event == \"error\"",{"type":44,"value":3939},{"type":39,"tag":53,"props":4569,"children":4571},{"className":4570},[],[4572],{"type":44,"value":4134},{"type":44,"value":4501},{"type":39,"tag":53,"props":4575,"children":4577},{"className":4576},[],[4578],{"type":44,"value":4141},{"type":44,"value":4580},". Only present when classic-APM agents are in use.",{"type":39,"tag":47,"props":4582,"children":4583},{},[4584,4586,4591,4592,4597,4599,4604,4606,4611,4613,4619,4621,4626,4627,4633,4635,4640],{"type":44,"value":4585},"The trace doc always carries ",{"type":39,"tag":53,"props":4587,"children":4589},{"className":4588},[],[4590],{"type":44,"value":4066},{"type":44,"value":4501},{"type":39,"tag":53,"props":4593,"children":4595},{"className":4594},[],[4596],{"type":44,"value":4522},{"type":44,"value":4598}," regardless. If your ",{"type":39,"tag":53,"props":4600,"children":4602},{"className":4601},[],[4603],{"type":44,"value":4111},{"type":44,"value":4605}," query against ",{"type":39,"tag":53,"props":4607,"children":4609},{"className":4608},[],[4610],{"type":44,"value":1960},{"type":44,"value":4612}," returns ",{"type":39,"tag":53,"props":4614,"children":4616},{"className":4615},[],[4617],{"type":44,"value":4618},"Unknown column [exception.message]",{"type":44,"value":4620},", the deployment is shape 2 — switch to ",{"type":39,"tag":53,"props":4622,"children":4624},{"className":4623},[],[4625],{"type":44,"value":4479},{"type":44,"value":1666},{"type":39,"tag":53,"props":4628,"children":4630},{"className":4629},[],[4631],{"type":44,"value":4632},"WHERE exception.message IS NOT NULL",{"type":44,"value":4634}," and join back to the trace via ",{"type":39,"tag":53,"props":4636,"children":4638},{"className":4637},[],[4639],{"type":44,"value":4499},{"type":44,"value":4641}," if needed. Don't assume the original index has the field just because the user said \"from traces\".",{"type":39,"tag":47,"props":4643,"children":4644},{},[4645],{"type":44,"value":4646},"Service p95 latency (OTel-native), last 15m — result in ms:",{"type":39,"tag":99,"props":4648,"children":4651},{"className":4649,"code":4650,"language":44},[102],"FROM traces-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND kind == \"Server\"\n| STATS p95_ms = PERCENTILE(duration, 95) \u002F 1000000\n",[4652],{"type":39,"tag":53,"props":4653,"children":4654},{"__ignoreMap":107},[4655],{"type":44,"value":4650},{"type":39,"tag":47,"props":4657,"children":4658},{},[4659,4661,4666],{"type":44,"value":4660},"Error rate for a service — ",{"type":39,"tag":53,"props":4662,"children":4664},{"className":4663},[],[4665],{"type":44,"value":1989},{"type":44,"value":4667}," is reliable here:",{"type":39,"tag":99,"props":4669,"children":4672},{"className":4670,"code":4671,"language":44},[102],"FROM traces-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND kind == \"Server\"\n| STATS errors = COUNT(*) WHERE event.outcome == \"failure\", total = COUNT(*)\n| EVAL error_rate_pct = ROUND(errors * 100.0 \u002F total, 2)\n| KEEP error_rate_pct, errors, total\n",[4673],{"type":39,"tag":53,"props":4674,"children":4675},{"__ignoreMap":107},[4676],{"type":44,"value":4671},{"type":39,"tag":47,"props":4678,"children":4679},{},[4680],{"type":44,"value":4681},"Recent exception messages — try the trace index first (flattened-event pipelines), then fall back to logs (default OTel Collector pipeline):",{"type":39,"tag":47,"props":4683,"children":4684},{},[4685],{"type":39,"tag":157,"props":4686,"children":4687},{},[4688],{"type":44,"value":4689},"1) Trace doc carries the exception (EDOT-flattened pipelines):",{"type":39,"tag":99,"props":4691,"children":4694},{"className":4692,"code":4693,"language":44},[102],"FROM traces-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND event.outcome == \"failure\"\n AND exception.message IS NOT NULL\n| KEEP @timestamp, exception.type, exception.message\n| SORT @timestamp DESC\n| LIMIT 50\n",[4695],{"type":39,"tag":53,"props":4696,"children":4697},{"__ignoreMap":107},[4698],{"type":44,"value":4693},{"type":39,"tag":47,"props":4700,"children":4701},{},[4702],{"type":39,"tag":157,"props":4703,"children":4704},{},[4705,4707,4712],{"type":44,"value":4706},"2) Exception lives in logs (default OTel pipeline) — use this when (1) returns ",{"type":39,"tag":53,"props":4708,"children":4710},{"className":4709},[],[4711],{"type":44,"value":4618},{"type":44,"value":4713}," or empty:",{"type":39,"tag":99,"props":4715,"children":4718},{"className":4716,"code":4717,"language":44},[102],"FROM logs-*.otel-*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND exception.message IS NOT NULL\n| KEEP @timestamp, exception.type, exception.message, trace.id, span.id\n| SORT @timestamp DESC\n| LIMIT 50\n",[4719],{"type":39,"tag":53,"props":4720,"children":4721},{"__ignoreMap":107},[4722],{"type":44,"value":4717},{"type":39,"tag":47,"props":4724,"children":4725},{},[4726],{"type":39,"tag":157,"props":4727,"children":4728},{},[4729],{"type":44,"value":4730},"3) Classic-APM equivalent — only when both OTel paths return empty:",{"type":39,"tag":99,"props":4732,"children":4735},{"className":4733,"code":4734,"language":44},[102],"FROM traces-apm*\n| WHERE service.name == \"checkout\" AND @timestamp > NOW() - 15 minutes\n AND processor.event == \"error\"\n| KEEP @timestamp, error.exception.type, error.message\n| SORT @timestamp DESC\n| LIMIT 50\n",[4736],{"type":39,"tag":53,"props":4737,"children":4738},{"__ignoreMap":107},[4739],{"type":44,"value":4734},{"type":39,"tag":47,"props":4741,"children":4742},{},[4743,4745,4750,4752,4757,4758,4763,4764,4769],{"type":44,"value":4744},"If ",{"type":39,"tag":53,"props":4746,"children":4748},{"className":4747},[],[4749],{"type":44,"value":1960},{"type":44,"value":4751}," returns empty, the deployment is classic-APM-only — fall back to ",{"type":39,"tag":53,"props":4753,"children":4755},{"className":4754},[],[4756],{"type":44,"value":1967},{"type":44,"value":1666},{"type":39,"tag":53,"props":4759,"children":4761},{"className":4760},[],[4762],{"type":44,"value":4047},{"type":44,"value":4501},{"type":39,"tag":53,"props":4765,"children":4767},{"className":4766},[],[4768],{"type":44,"value":1982},{"type":44,"value":362},{"type":39,"tag":47,"props":4771,"children":4772},{},[4773,4778,4779,4785,4787,4793,4795,4800,4802,4807],{"type":39,"tag":157,"props":4774,"children":4775},{},[4776],{"type":44,"value":4777},"Throughput trend — use the pre-aggregated rollup when possible.",{"type":44,"value":2115},{"type":39,"tag":53,"props":4780,"children":4782},{"className":4781},[],[4783],{"type":44,"value":4784},"metrics-service_summary.1m.otel-*",{"type":44,"value":4786}," carries per-minute request counts in ",{"type":39,"tag":53,"props":4788,"children":4790},{"className":4789},[],[4791],{"type":44,"value":4792},"service_summary",{"type":44,"value":4794}," (a regular ",{"type":39,"tag":53,"props":4796,"children":4798},{"className":4797},[],[4799],{"type":44,"value":2393},{"type":44,"value":4801},", designed to ",{"type":39,"tag":53,"props":4803,"children":4805},{"className":4804},[],[4806],{"type":44,"value":2262},{"type":44,"value":4808},"). Cheaper and faster than scanning raw traces for \"how many requests\u002Fmin over the last hour\":",{"type":39,"tag":99,"props":4810,"children":4813},{"className":4811,"code":4812,"language":44},[102],"FROM metrics-service_summary.1m.otel-*\n| WHERE service.name == \"frontend\" AND @timestamp > NOW() - 1 hour\n| STATS throughput = SUM(service_summary)\n BY bucket = BUCKET(@timestamp, 1 minute)\n| SORT bucket ASC\n",[4814],{"type":39,"tag":53,"props":4815,"children":4816},{"__ignoreMap":107},[4817],{"type":44,"value":4812},{"type":39,"tag":92,"props":4819,"children":4821},{"id":4820},"log-rate",[4822],{"type":44,"value":4823},"Log rate",{"type":39,"tag":47,"props":4825,"children":4826},{},[4827,4828],{"type":44,"value":2281},{"type":39,"tag":53,"props":4829,"children":4831},{"className":4830},[],[4832],{"type":44,"value":2013},{"type":39,"tag":99,"props":4834,"children":4837},{"className":4835,"code":4836,"language":44},[102],"FROM logs-*\n| WHERE service.name == \"cartservice\" AND @timestamp > NOW() - 5m\n| STATS v = COUNT(*)\n",[4838],{"type":39,"tag":53,"props":4839,"children":4840},{"__ignoreMap":107},[4841],{"type":44,"value":4836},{"type":39,"tag":92,"props":4843,"children":4845},{"id":4844},"query-construction-rules",[4846],{"type":44,"value":4847},"Query-construction rules",{"type":39,"tag":328,"props":4849,"children":4850},{},[4851,4875,4888,4922,4955,5156],{"type":39,"tag":332,"props":4852,"children":4853},{},[4854,4855,4860,4861,4866,4868,4873],{"type":44,"value":2614},{"type":39,"tag":53,"props":4856,"children":4858},{"className":4857},[],[4859],{"type":44,"value":73},{"type":44,"value":4501},{"type":39,"tag":53,"props":4862,"children":4864},{"className":4863},[],[4865],{"type":44,"value":221},{"type":44,"value":4867}," mode, the query must return a single row with a numeric first column —\nthe tool reads the first numeric cell. For ",{"type":39,"tag":53,"props":4869,"children":4871},{"className":4870},[],[4872],{"type":44,"value":81},{"type":44,"value":4874}," mode this restriction doesn't apply: any\nshape is fine.",{"type":39,"tag":332,"props":4876,"children":4877},{},[4878,4880,4886],{"type":44,"value":4879},"Scope with ",{"type":39,"tag":53,"props":4881,"children":4883},{"className":4882},[],[4884],{"type":44,"value":4885},"@timestamp > NOW() - \u003Cwindow>",{"type":44,"value":4887}," when the user implies \"right now\" (default 5m is\nusually fine; let the window match the user's language).",{"type":39,"tag":332,"props":4889,"children":4890},{},[4891,4893,4898,4900,4905,4907,4912,4914,4920],{"type":44,"value":4892},"When the user names a namespace, match it exactly (e.g. ",{"type":39,"tag":53,"props":4894,"children":4896},{"className":4895},[],[4897],{"type":44,"value":1088},{"type":44,"value":4899},", not\n",{"type":39,"tag":53,"props":4901,"children":4903},{"className":4902},[],[4904],{"type":44,"value":664},{"type":44,"value":4906},"). If unsure, call ",{"type":39,"tag":53,"props":4908,"children":4910},{"className":4909},[],[4911],{"type":44,"value":406},{"type":44,"value":4913}," first — its ",{"type":39,"tag":53,"props":4915,"children":4917},{"className":4916},[],[4918],{"type":44,"value":4919},"namespace_candidates",{"type":44,"value":4921}," field\nsurfaces fuzzy matches.",{"type":39,"tag":332,"props":4923,"children":4924},{},[4925,4930,4932,4938,4939,4945,4947,4953],{"type":39,"tag":157,"props":4926,"children":4927},{},[4928],{"type":44,"value":4929},"String literals use double quotes only.",{"type":44,"value":4931}," ES|QL does not accept single quotes — ",{"type":39,"tag":53,"props":4933,"children":4935},{"className":4934},[],[4936],{"type":44,"value":4937},"WHERE kind == \"Server\"",{"type":44,"value":2334},{"type":39,"tag":53,"props":4940,"children":4942},{"className":4941},[],[4943],{"type":44,"value":4944},"WHERE kind == 'Server'",{"type":44,"value":4946},". Single quotes cause ",{"type":39,"tag":53,"props":4948,"children":4950},{"className":4949},[],[4951],{"type":44,"value":4952},"token recognition error",{"type":44,"value":4954}," failures.",{"type":39,"tag":332,"props":4956,"children":4957},{},[4958,4963,4965],{"type":39,"tag":157,"props":4959,"children":4960},{},[4961],{"type":44,"value":4962},"Match the aggregation to the field's storage shape.",{"type":44,"value":4964}," Three shapes to recognize:",{"type":39,"tag":328,"props":4966,"children":4967},{},[4968,5045,5112],{"type":39,"tag":332,"props":4969,"children":4970},{},[4971,4976,4977,4983,4984,4990,4991,4997,4998,5004,5006,5011,5013,5018,5019,5024,5025,5030,5031,5043],{"type":39,"tag":157,"props":4972,"children":4973},{},[4974],{"type":44,"value":4975},"Gauges",{"type":44,"value":4202},{"type":39,"tag":53,"props":4978,"children":4980},{"className":4979},[],[4981],{"type":44,"value":4982},"memory.working_set",{"type":44,"value":949},{"type":39,"tag":53,"props":4985,"children":4987},{"className":4986},[],[4988],{"type":44,"value":4989},"memory.available",{"type":44,"value":949},{"type":39,"tag":53,"props":4992,"children":4994},{"className":4993},[],[4995],{"type":44,"value":4996},"cpu.usage",{"type":44,"value":949},{"type":39,"tag":53,"props":4999,"children":5001},{"className":5000},[],[5002],{"type":44,"value":5003},"filesystem.usage",{"type":44,"value":5005}," in\n",{"type":39,"tag":53,"props":5007,"children":5009},{"className":5008},[],[5010],{"type":44,"value":1904},{"type":44,"value":5012},"): use ",{"type":39,"tag":53,"props":5014,"children":5016},{"className":5015},[],[5017],{"type":44,"value":2247},{"type":44,"value":75},{"type":39,"tag":53,"props":5020,"children":5022},{"className":5021},[],[5023],{"type":44,"value":2255},{"type":44,"value":75},{"type":39,"tag":53,"props":5026,"children":5028},{"className":5027},[],[5029],{"type":44,"value":2332},{"type":44,"value":3759},{"type":39,"tag":157,"props":5032,"children":5033},{},[5034,5036,5041],{"type":44,"value":5035},"Do not ",{"type":39,"tag":53,"props":5037,"children":5039},{"className":5038},[],[5040],{"type":44,"value":2262},{"type":44,"value":5042}," a gauge",{"type":44,"value":5044}," — it\nwill add every ~15s kubelet sample over your window and inflate the value by hundreds or\nthousands.",{"type":39,"tag":332,"props":5046,"children":5047},{},[5048,5053,5054,5059,5060,5065,5067,5072,5074,5079,5080,5085,5087,5092,5093,5098,5099,5104,5105,5110],{"type":39,"tag":157,"props":5049,"children":5050},{},[5051],{"type":44,"value":5052},"Counters",{"type":44,"value":4202},{"type":39,"tag":53,"props":5055,"children":5057},{"className":5056},[],[5058],{"type":44,"value":3435},{"type":44,"value":949},{"type":39,"tag":53,"props":5061,"children":5063},{"className":5062},[],[5064],{"type":44,"value":3521},{"type":44,"value":5066},", etc. — ",{"type":39,"tag":53,"props":5068,"children":5070},{"className":5069},[],[5071],{"type":44,"value":2197},{"type":44,"value":5073}," type): require\n",{"type":39,"tag":53,"props":5075,"children":5077},{"className":5076},[],[5078],{"type":44,"value":2217},{"type":44,"value":2219},{"type":39,"tag":53,"props":5081,"children":5083},{"className":5082},[],[5084],{"type":44,"value":2225},{"type":44,"value":5086},". See the \"Counter fields\" section above. ",{"type":39,"tag":53,"props":5088,"children":5090},{"className":5089},[],[5091],{"type":44,"value":2209},{"type":44,"value":2219},{"type":39,"tag":53,"props":5094,"children":5096},{"className":5095},[],[5097],{"type":44,"value":2255},{"type":44,"value":2990},{"type":39,"tag":53,"props":5100,"children":5102},{"className":5101},[],[5103],{"type":44,"value":2247},{"type":44,"value":2990},{"type":39,"tag":53,"props":5106,"children":5108},{"className":5107},[],[5109],{"type":44,"value":2262},{"type":44,"value":5111}," on a\ncounter is a hard error, not a silent wrong number.",{"type":39,"tag":332,"props":5113,"children":5114},{},[5115,5120,5121,5126,5128,5133,5134,5140,5141,5147,5149,5154],{"type":39,"tag":157,"props":5116,"children":5117},{},[5118],{"type":44,"value":5119},"Pre-aggregated rollups",{"type":44,"value":4202},{"type":39,"tag":53,"props":5122,"children":5124},{"className":5123},[],[5125],{"type":44,"value":4792},{"type":44,"value":5127}," on ",{"type":39,"tag":53,"props":5129,"children":5131},{"className":5130},[],[5132],{"type":44,"value":4784},{"type":44,"value":574},{"type":39,"tag":53,"props":5135,"children":5137},{"className":5136},[],[5138],{"type":44,"value":5139},"span.destination.service.response_time.count",{"type":44,"value":5127},{"type":39,"tag":53,"props":5142,"children":5144},{"className":5143},[],[5145],{"type":44,"value":5146},"metrics-service_destination.1m.otel-*",{"type":44,"value":5148},"):\ndesigned for ",{"type":39,"tag":53,"props":5150,"children":5152},{"className":5151},[],[5153],{"type":44,"value":2262},{"type":44,"value":5155}," across the window. Each doc is already a per-minute bucket count.",{"type":39,"tag":332,"props":5157,"children":5158},{},[5159,5171,5173,5179,5181,5190,5194,5199,5201,5207,5209,5215,5216,5222,5223,5229,5231,5237,5239,5245],{"type":39,"tag":157,"props":5160,"children":5161},{},[5162,5163,5169],{"type":44,"value":3047},{"type":39,"tag":53,"props":5164,"children":5166},{"className":5165},[],[5167],{"type":44,"value":5168},"CHANGE_POINT",{"type":44,"value":5170}," to detect regime shifts automatically",{"type":44,"value":5172}," on time-bucketed results rather than\neyeballing the table. Append it after any ",{"type":39,"tag":53,"props":5174,"children":5176},{"className":5175},[],[5177],{"type":44,"value":5178},"STATS ... BY BUCKET(@timestamp, interval)",{"type":44,"value":5180}," query when\nthe user asks about spikes, dips, or anomalies in a metric over time:",{"type":39,"tag":99,"props":5182,"children":5185},{"className":5183,"code":5184,"language":44},[102],"FROM metrics-kubeletstatsreceiver.otel*\n| WHERE @timestamp > NOW() - 24 hours AND k8s.node.cpu.usage IS NOT NULL\n| STATS avg_cpu = AVG(k8s.node.cpu.usage) BY bucket = BUCKET(@timestamp, 1 hour)\n| SORT bucket ASC\n| CHANGE_POINT avg_cpu ON bucket\n| WHERE type IS NOT NULL\n",[5186],{"type":39,"tag":53,"props":5187,"children":5188},{"__ignoreMap":107},[5189],{"type":44,"value":5184},{"type":39,"tag":5191,"props":5192,"children":5193},"br",{},[],{"type":39,"tag":53,"props":5195,"children":5197},{"className":5196},[],[5198],{"type":44,"value":5168},{"type":44,"value":5200}," appends ",{"type":39,"tag":53,"props":5202,"children":5204},{"className":5203},[],[5205],{"type":44,"value":5206},"type",{"type":44,"value":5208}," (e.g. ",{"type":39,"tag":53,"props":5210,"children":5212},{"className":5211},[],[5213],{"type":44,"value":5214},"step_change",{"type":44,"value":949},{"type":39,"tag":53,"props":5217,"children":5219},{"className":5218},[],[5220],{"type":44,"value":5221},"spike",{"type":44,"value":949},{"type":39,"tag":53,"props":5224,"children":5226},{"className":5225},[],[5227],{"type":44,"value":5228},"dip",{"type":44,"value":5230},") and ",{"type":39,"tag":53,"props":5232,"children":5234},{"className":5233},[],[5235],{"type":44,"value":5236},"pvalue",{"type":44,"value":5238}," columns. Filter\n",{"type":39,"tag":53,"props":5240,"children":5242},{"className":5241},[],[5243],{"type":44,"value":5244},"WHERE type IS NOT NULL",{"type":44,"value":5246}," to surface only the detected change points. Works on any numeric\ntime-bucketed series — CPU, memory, error rates, throughput.",{"type":39,"tag":85,"props":5248,"children":5250},{"id":5249},"after-the-tool-returns",[5251],{"type":44,"value":5252},"After the tool returns",{"type":39,"tag":47,"props":5254,"children":5255},{},[5256,5262],{"type":39,"tag":53,"props":5257,"children":5259},{"className":5258},[],[5260],{"type":44,"value":5261},"_setup_notice",{"type":44,"value":5263}," is view-side chrome — don't echo or summarize it in chat. There are three\nvariants:",{"type":39,"tag":328,"props":5265,"children":5266},{},[5267,5285],{"type":39,"tag":332,"props":5268,"children":5269},{},[5270,5276,5277,5283],{"type":39,"tag":53,"props":5271,"children":5273},{"className":5272},[],[5274],{"type":44,"value":5275},"welcome",{"type":44,"value":4501},{"type":39,"tag":53,"props":5278,"children":5280},{"className":5279},[],[5281],{"type":44,"value":5282},"skill-gap",{"type":44,"value":5284}," are user-facing nudges to install the skill packs. Ignore them.",{"type":39,"tag":332,"props":5286,"children":5287},{},[5288,5294,5296,5301,5303,5308,5310,5315],{"type":39,"tag":53,"props":5289,"children":5291},{"className":5290},[],[5292],{"type":44,"value":5293},"schema-hint",{"type":44,"value":5295}," is an actionable retry instruction the server emits when your query failed in a\nway the latest skill ",{"type":39,"tag":2117,"props":5297,"children":5298},{},[5299],{"type":44,"value":5300},"expects",{"type":44,"value":5302}," on this deployment shape (e.g. exceptions live in\n",{"type":39,"tag":53,"props":5304,"children":5306},{"className":5305},[],[5307],{"type":44,"value":4479},{"type":44,"value":5309}," instead of on the trace doc). Read its ",{"type":39,"tag":53,"props":5311,"children":5313},{"className":5312},[],[5314],{"type":44,"value":2022},{"type":44,"value":5316}," and adapt your next call\naccordingly — don't surface the banner text in chat, but do follow its guidance.",{"type":39,"tag":47,"props":5318,"children":5319},{},[5320],{"type":44,"value":5321},"The observe MCP App view renders inline in one of several modes, picked automatically from the result:",{"type":39,"tag":328,"props":5323,"children":5324},{},[5325,5342,5373,5383,5400],{"type":39,"tag":332,"props":5326,"children":5327},{},[5328,5340],{"type":39,"tag":157,"props":5329,"children":5330},{},[5331,5333,5339],{"type":44,"value":5332},"Now mode (",{"type":39,"tag":53,"props":5334,"children":5336},{"className":5335},[],[5337],{"type":44,"value":5338},"status: NOW",{"type":44,"value":4094},{"type":44,"value":5341}," — compact card: big unit-formatted number, ES|QL subtitle, \"evaluated\nXs ago\" stamp, and three follow-up actions (re-check, escalate to live observation, create alert rule).",{"type":39,"tag":332,"props":5343,"children":5344},{},[5345,5350,5352,5358,5359,5365,5366,5372],{"type":39,"tag":157,"props":5346,"children":5347},{},[5348],{"type":44,"value":5349},"Metric mode",{"type":44,"value":5351}," — area + line + dots sparkline with optional threshold line; stat cards for\ncurrent \u002F threshold \u002F peak \u002F baseline. Covers ",{"type":39,"tag":53,"props":5353,"children":5355},{"className":5354},[],[5356],{"type":44,"value":5357},"CONDITION_MET",{"type":44,"value":949},{"type":39,"tag":53,"props":5360,"children":5362},{"className":5361},[],[5363],{"type":44,"value":5364},"TIMEOUT",{"type":44,"value":3367},{"type":39,"tag":53,"props":5367,"children":5369},{"className":5368},[],[5370],{"type":44,"value":5371},"SAMPLED",{"type":44,"value":362},{"type":39,"tag":332,"props":5374,"children":5375},{},[5376,5381],{"type":39,"tag":157,"props":5377,"children":5378},{},[5379],{"type":44,"value":5380},"Anomaly mode",{"type":44,"value":5382}," — severity-scored trigger card with affected entities and click-to-send\ninvestigation prompts.",{"type":39,"tag":332,"props":5384,"children":5385},{},[5386,5398],{"type":39,"tag":157,"props":5387,"children":5388},{},[5389,5391,5397],{"type":44,"value":5390},"Table mode (",{"type":39,"tag":53,"props":5392,"children":5394},{"className":5393},[],[5395],{"type":44,"value":5396},"status: TABLE",{"type":44,"value":4094},{"type":44,"value":5399}," — styled HTML table with column headers, type-aware alignment\n(numeric right, text left), and zebra-striped rows. Row count + truncation notice in the subtitle.",{"type":39,"tag":332,"props":5401,"children":5402},{},[5403,5415],{"type":39,"tag":157,"props":5404,"children":5405},{},[5406,5408,5414],{"type":44,"value":5407},"Error (",{"type":39,"tag":53,"props":5409,"children":5411},{"className":5410},[],[5412],{"type":44,"value":5413},"status: ERROR",{"type":44,"value":4094},{"type":44,"value":5416}," — red-toned card with the ES|QL failure message verbatim. Surfaces\ninstead of throwing when the query is bad (unknown field, index missing, syntax error).",{"type":39,"tag":47,"props":5418,"children":5419},{},[5420,5422,5428],{"type":44,"value":5421},"All modes surface an ",{"type":39,"tag":53,"props":5423,"children":5425},{"className":5424},[],[5426],{"type":44,"value":5427},"investigation_actions",{"type":44,"value":5429}," list as buttons. Follow up in chat too — don't rely\non the buttons alone.",{"type":39,"tag":92,"props":5431,"children":5433},{"id":5432},"status-by-status-guidance",[5434],{"type":44,"value":5435},"Status-by-status guidance",{"type":39,"tag":328,"props":5437,"children":5438},{},[5439,5453,5467,5481,5510,5529,5542,5563],{"type":39,"tag":332,"props":5440,"children":5441},{},[5442,5451],{"type":39,"tag":157,"props":5443,"children":5444},{},[5445],{"type":39,"tag":53,"props":5446,"children":5448},{"className":5447},[],[5449],{"type":44,"value":5450},"NOW",{"type":44,"value":5452}," — State the value plainly. Offer to escalate to a live observation if the user seems to\nwant ongoing visibility.",{"type":39,"tag":332,"props":5454,"children":5455},{},[5456,5465],{"type":39,"tag":157,"props":5457,"children":5458},{},[5459],{"type":39,"tag":53,"props":5460,"children":5462},{"className":5461},[],[5463],{"type":44,"value":5464},"TABLE",{"type":44,"value":5466}," — Summarize what the rows show (top entity, total count, any outliers). Don't just\ndump the full table back — the user can read the widget. If the result was truncated, say so and\noffer to tighten the ES|QL.",{"type":39,"tag":332,"props":5468,"children":5469},{},[5470,5479],{"type":39,"tag":157,"props":5471,"children":5472},{},[5473],{"type":39,"tag":53,"props":5474,"children":5476},{"className":5475},[],[5477],{"type":44,"value":5478},"ERROR",{"type":44,"value":5480}," — Read the error message, explain what likely went wrong (unknown field, index\npattern, syntax), and propose a corrected query. Don't retry blindly.",{"type":39,"tag":332,"props":5482,"children":5483},{},[5484,5493,5495,5501,5503,5508],{"type":39,"tag":157,"props":5485,"children":5486},{},[5487],{"type":39,"tag":53,"props":5488,"children":5490},{"className":5489},[],[5491],{"type":44,"value":5492},"ALERT",{"type":44,"value":5494}," (anomaly fired) — The response includes affected entities, affected services, top\nanomalies, and ",{"type":39,"tag":53,"props":5496,"children":5498},{"className":5497},[],[5499],{"type":44,"value":5500},"investigation_hints",{"type":44,"value":5502}," naming the next tool to reach for. ",{"type":39,"tag":157,"props":5504,"children":5505},{},[5506],{"type":44,"value":5507},"Follow those hints\nimmediately",{"type":44,"value":5509}," — don't just report the alert, start investigating and narrate your reasoning.",{"type":39,"tag":332,"props":5511,"children":5512},{},[5513,5521,5523,5528],{"type":39,"tag":157,"props":5514,"children":5515},{},[5516],{"type":39,"tag":53,"props":5517,"children":5519},{"className":5518},[],[5520],{"type":44,"value":5357},{"type":44,"value":5522}," (metric threshold satisfied) — Confirm to the user and describe the trend\nfrom the returned history. If this was post-remediation validation, explicitly state the fix has\nbeen validated. Offer to graduate the condition into a durable rule via ",{"type":39,"tag":53,"props":5524,"children":5526},{"className":5525},[],[5527],{"type":44,"value":58},{"type":44,"value":362},{"type":39,"tag":332,"props":5530,"children":5531},{},[5532,5540],{"type":39,"tag":157,"props":5533,"children":5534},{},[5535],{"type":39,"tag":53,"props":5536,"children":5538},{"className":5537},[],[5539],{"type":44,"value":5371},{"type":44,"value":5541}," (live sample completed without a condition) — Summarize the trend (trending up \u002F\ndown \u002F flat, peak, typical). Offer \"keep observing\" (extend window) or graduate to an alert rule.",{"type":39,"tag":332,"props":5543,"children":5544},{},[5545,5553,5555,5561],{"type":39,"tag":157,"props":5546,"children":5547},{},[5548],{"type":39,"tag":53,"props":5549,"children":5551},{"className":5550},[],[5552],{"type":44,"value":5364},{"type":44,"value":5554}," (metric condition never met) — Tell the user the metric didn't stabilize. Suggest\nfollow-ups: check ",{"type":39,"tag":53,"props":5556,"children":5558},{"className":5557},[],[5559],{"type":44,"value":5560},"ml-anomalies",{"type":44,"value":5562},", persist as alert rule, re-examine the ES|QL.",{"type":39,"tag":332,"props":5564,"children":5565},{},[5566,5575,5577,5582,5584,5590],{"type":39,"tag":157,"props":5567,"children":5568},{},[5569],{"type":39,"tag":53,"props":5570,"children":5572},{"className":5571},[],[5573],{"type":44,"value":5574},"QUIET",{"type":44,"value":5576}," (anomaly mode, nothing fired) — Suggest adjustments: lower ",{"type":39,"tag":53,"props":5578,"children":5580},{"className":5579},[],[5581],{"type":44,"value":587},{"type":44,"value":5583},", widen\n",{"type":39,"tag":53,"props":5585,"children":5587},{"className":5586},[],[5588],{"type":44,"value":5589},"lookback",{"type":44,"value":5591},", verify ML jobs are running.",{"type":39,"tag":85,"props":5593,"children":5595},{"id":5594},"accumulating-timelines",[5596],{"type":44,"value":5597},"Accumulating timelines",{"type":39,"tag":47,"props":5599,"children":5600},{},[5601,5603,5609,5611,5617],{"type":44,"value":5602},"Every metric-mode response includes an ",{"type":39,"tag":53,"props":5604,"children":5606},{"className":5605},[],[5607],{"type":44,"value":5608},"observe_key",{"type":44,"value":5610}," derived from ",{"type":39,"tag":53,"props":5612,"children":5614},{"className":5613},[],[5615],{"type":44,"value":5616},"esql + condition",{"type":44,"value":5618},". When Claude\nre-invokes observe with the same ES|QL (e.g. via the \"Extend observation (+60s)\" button), the view\nmerges the new samples into the existing sparkline instead of resetting — so the user sees a\ncontinuous timeline across multiple tool calls. To keep this continuity, reuse the exact same\nES|QL string and condition when extending. Capped at 240 points to keep the chart readable.",{"type":39,"tag":85,"props":5620,"children":5622},{"id":5621},"tools",[5623],{"type":44,"value":5624},"Tools",{"type":39,"tag":81,"props":5626,"children":5627},{},[5628,5644],{"type":39,"tag":114,"props":5629,"children":5630},{},[5631],{"type":39,"tag":118,"props":5632,"children":5633},{},[5634,5639],{"type":39,"tag":122,"props":5635,"children":5636},{},[5637],{"type":44,"value":5638},"Tool",{"type":39,"tag":122,"props":5640,"children":5641},{},[5642],{"type":44,"value":5643},"Purpose",{"type":39,"tag":138,"props":5645,"children":5646},{},[5647,5687,5703,5720,5736,5753],{"type":39,"tag":118,"props":5648,"children":5649},{},[5650,5658],{"type":39,"tag":145,"props":5651,"children":5652},{},[5653],{"type":39,"tag":53,"props":5654,"children":5656},{"className":5655},[],[5657],{"type":44,"value":4},{"type":39,"tag":145,"props":5659,"children":5660},{},[5661,5663,5668,5669,5674,5675,5680,5681,5686],{"type":44,"value":5662},"Polls and blocks. Four modes: ",{"type":39,"tag":53,"props":5664,"children":5666},{"className":5665},[],[5667],{"type":44,"value":277},{"type":44,"value":949},{"type":39,"tag":53,"props":5670,"children":5672},{"className":5671},[],[5673],{"type":44,"value":221},{"type":44,"value":949},{"type":39,"tag":53,"props":5676,"children":5678},{"className":5677},[],[5679],{"type":44,"value":73},{"type":44,"value":949},{"type":39,"tag":53,"props":5682,"children":5684},{"className":5683},[],[5685],{"type":44,"value":81},{"type":44,"value":362},{"type":39,"tag":118,"props":5688,"children":5689},{},[5690,5698],{"type":39,"tag":145,"props":5691,"children":5692},{},[5693],{"type":39,"tag":53,"props":5694,"children":5696},{"className":5695},[],[5697],{"type":44,"value":5560},{"type":39,"tag":145,"props":5699,"children":5700},{},[5701],{"type":44,"value":5702},"Follow-up: deeper look at the anomaly that fired.",{"type":39,"tag":118,"props":5704,"children":5705},{},[5706,5715],{"type":39,"tag":145,"props":5707,"children":5708},{},[5709],{"type":39,"tag":53,"props":5710,"children":5712},{"className":5711},[],[5713],{"type":44,"value":5714},"apm-service-dependencies",{"type":39,"tag":145,"props":5716,"children":5717},{},[5718],{"type":44,"value":5719},"Follow-up: topology of affected services (if APM available).",{"type":39,"tag":118,"props":5721,"children":5722},{},[5723,5731],{"type":39,"tag":145,"props":5724,"children":5725},{},[5726],{"type":39,"tag":53,"props":5727,"children":5729},{"className":5728},[],[5730],{"type":44,"value":406},{"type":39,"tag":145,"props":5732,"children":5733},{},[5734],{"type":44,"value":5735},"Follow-up: cluster-wide context, and useful for discovering which namespaces actually have data.",{"type":39,"tag":118,"props":5737,"children":5738},{},[5739,5748],{"type":39,"tag":145,"props":5740,"children":5741},{},[5742],{"type":39,"tag":53,"props":5743,"children":5745},{"className":5744},[],[5746],{"type":44,"value":5747},"k8s-blast-radius",{"type":39,"tag":145,"props":5749,"children":5750},{},[5751],{"type":44,"value":5752},"Follow-up: infra impact if a node is implicated.",{"type":39,"tag":118,"props":5754,"children":5755},{},[5756,5764],{"type":39,"tag":145,"props":5757,"children":5758},{},[5759],{"type":39,"tag":53,"props":5760,"children":5762},{"className":5761},[],[5763],{"type":44,"value":58},{"type":39,"tag":145,"props":5765,"children":5766},{},[5767],{"type":44,"value":5768},"Graduate to persistent alerting once the pattern is well-understood.",{"type":39,"tag":85,"props":5770,"children":5772},{"id":5771},"key-principles",[5773],{"type":44,"value":5774},"Key principles",{"type":39,"tag":328,"props":5776,"children":5777},{},[5778,5794,5851,5875,5892,5930],{"type":39,"tag":332,"props":5779,"children":5780},{},[5781,5786,5788,5793],{"type":39,"tag":157,"props":5782,"children":5783},{},[5784],{"type":44,"value":5785},"Observe is transient.",{"type":44,"value":5787}," Nothing is saved. If the user wants an ongoing rule, use ",{"type":39,"tag":53,"props":5789,"children":5791},{"className":5790},[],[5792],{"type":44,"value":58},{"type":44,"value":362},{"type":39,"tag":332,"props":5795,"children":5796},{},[5797,5802,5804,5809,5811,5816,5818,5823,5825,5830,5832,5837,5839,5844,5845,5850],{"type":39,"tag":157,"props":5798,"children":5799},{},[5800],{"type":44,"value":5801},"Pick the mode from the user's phrasing.",{"type":44,"value":5803}," \"What is X right now\" (scalar) → ",{"type":39,"tag":53,"props":5805,"children":5807},{"className":5806},[],[5808],{"type":44,"value":73},{"type":44,"value":5810},". \"Show me a\nlive chart of X\" or \"watch X for 60s\" → ",{"type":39,"tag":53,"props":5812,"children":5814},{"className":5813},[],[5815],{"type":44,"value":221},{"type":44,"value":5817}," (no condition). \"Wait until X drops below Y\" →\n",{"type":39,"tag":53,"props":5819,"children":5821},{"className":5820},[],[5822],{"type":44,"value":221},{"type":44,"value":5824}," (with condition). \"Tell me when anything unusual fires\" → ",{"type":39,"tag":53,"props":5826,"children":5828},{"className":5827},[],[5829],{"type":44,"value":277},{"type":44,"value":5831},". \"List …\", \"which\npods are on node X\", \"top N by Y\" → ",{"type":39,"tag":53,"props":5833,"children":5835},{"className":5834},[],[5836],{"type":44,"value":81},{"type":44,"value":5838},". If a user asks \"what is X\" and X is actually a list\nor grouping (not a single number), pick ",{"type":39,"tag":53,"props":5840,"children":5842},{"className":5841},[],[5843],{"type":44,"value":81},{"type":44,"value":3117},{"type":39,"tag":53,"props":5846,"children":5848},{"className":5847},[],[5849],{"type":44,"value":73},{"type":44,"value":362},{"type":39,"tag":332,"props":5852,"children":5853},{},[5854,5859,5861,5866,5868,5873],{"type":39,"tag":157,"props":5855,"children":5856},{},[5857],{"type":44,"value":5858},"Use the known field paths.",{"type":44,"value":5860}," Don't probe generic ",{"type":39,"tag":53,"props":5862,"children":5864},{"className":5863},[],[5865],{"type":44,"value":1911},{"type":44,"value":5867}," patterns when the deployment\nindexes under ",{"type":39,"tag":53,"props":5869,"children":5871},{"className":5870},[],[5872],{"type":44,"value":1904},{"type":44,"value":5874},". The cheat sheet above is authoritative for\nthis environment.",{"type":39,"tag":332,"props":5876,"children":5877},{},[5878,5883,5885,5890],{"type":39,"tag":157,"props":5879,"children":5880},{},[5881],{"type":44,"value":5882},"On ALERT, start investigating immediately.",{"type":44,"value":5884}," The ",{"type":39,"tag":53,"props":5886,"children":5888},{"className":5887},[],[5889],{"type":44,"value":5500},{"type":44,"value":5891}," are suggestions —\nfollow them and narrate your reasoning.",{"type":39,"tag":332,"props":5893,"children":5894},{},[5895,5907,5909,5914,5916,5921,5923,5928],{"type":39,"tag":157,"props":5896,"children":5897},{},[5898,5900,5905],{"type":44,"value":5899},"Don't start with ",{"type":39,"tag":53,"props":5901,"children":5903},{"className":5902},[],[5904],{"type":44,"value":4},{"type":44,"value":5906}," for vague triage.",{"type":44,"value":5908}," If the user reports a symptom without naming a\nspecific metric (\"something feels slow\", \"what's wrong with prod\"), reach for ",{"type":39,"tag":53,"props":5910,"children":5912},{"className":5911},[],[5913],{"type":44,"value":406},{"type":44,"value":5915},"\nfirst — it surfaces the worst-offender services without needing a query. ",{"type":39,"tag":53,"props":5917,"children":5919},{"className":5918},[],[5920],{"type":44,"value":4},{"type":44,"value":5922}," needs a target\nmetric to poll; use it to drill in ",{"type":39,"tag":2117,"props":5924,"children":5925},{},[5926],{"type":44,"value":5927},"after",{"type":44,"value":5929}," the rollup names something.",{"type":39,"tag":332,"props":5931,"children":5932},{},[5933,5944],{"type":39,"tag":157,"props":5934,"children":5935},{},[5936,5938,5943],{"type":44,"value":5937},"Don't over-tune ",{"type":39,"tag":53,"props":5939,"children":5941},{"className":5940},[],[5942],{"type":44,"value":587},{"type":44,"value":362},{"type":44,"value":5945}," 75 catches the important stuff; dropping below 50 produces noise.",{"type":39,"tag":85,"props":5947,"children":5949},{"id":5948},"investigation-discipline",[5950],{"type":44,"value":5951},"Investigation discipline",{"type":39,"tag":328,"props":5953,"children":5954},{},[5955,5965,5982],{"type":39,"tag":332,"props":5956,"children":5957},{},[5958,5963],{"type":39,"tag":157,"props":5959,"children":5960},{},[5961],{"type":44,"value":5962},"One tool call per turn.",{"type":44,"value":5964}," After this tool returns, narrate the headline finding before the next call. Each call adds a widget — chaining several after one \"yes\" looks like a runaway agent.",{"type":39,"tag":332,"props":5966,"children":5967},{},[5968,5973,5975,5980],{"type":39,"tag":157,"props":5969,"children":5970},{},[5971],{"type":44,"value":5972},"Sequential offers, not OR.",{"type":44,"value":5974}," \"Want me to check X ",{"type":39,"tag":2117,"props":5976,"children":5977},{},[5978],{"type":44,"value":5979},"or",{"type":44,"value":5981}," Y?\" → \"Want me to start with X? If it's inconclusive I can follow up with Y.\" The user's \"yes\" then maps to one call, not both.",{"type":39,"tag":332,"props":5983,"children":5984},{},[5985,5990,5992,5997],{"type":39,"tag":157,"props":5986,"children":5987},{},[5988],{"type":44,"value":5989},"Build queries from known fields.",{"type":44,"value":5991}," Use the cheat-sheet above — don't guess field names. If an \"Unknown column\" error returns with a \"did you mean…\" suggestion, ",{"type":39,"tag":2117,"props":5993,"children":5994},{},[5995],{"type":44,"value":5996},"read it",{"type":44,"value":5998}," and adjust; don't blindly retry.",{"type":39,"tag":6000,"props":6001,"children":6002},"style",{},[6003],{"type":44,"value":6004},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":6006,"total":672},[6007,6019,6029,6043,6057,6071],{"slug":406,"name":406,"fn":6008,"description":6009,"org":6010,"tags":6011,"stars":23,"repoUrl":24,"updatedAt":6018},"summarize Elastic APM service health","Get a cluster-level rollup of service health from APM telemetry — the \"how's my environment right now?\" entry point for observability investigations. Use whenever the user asks about HEALTH, STATUS, or general wellbeing of an environment \u002F cluster \u002F namespace (\"how's my cluster\", \"status of the X env\", \"what's broken\", \"any issues\", \"show me the health of …\", \"give me a status report\", \"what should I look at\", \"things feel slow\"). This applies regardless of any time qualifier — \"show me the health of X over the past hour\" still routes here (with lookback=\"1h\"), NOT to observe. observe is for raw-metric queries; this tool is for the rollup. Gracefully degrades: layers in Kubernetes pod data and ML anomaly context when those backends are present, but still returns useful APM-only output if they aren't. Do not use for log-only or metrics-only customers — this tool requires Elastic APM.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6012,6015,6016,6017],{"name":6013,"slug":6014,"type":15},"APM","apm",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:49:24.405551",{"slug":5714,"name":5714,"fn":6020,"description":6021,"org":6022,"tags":6023,"stars":23,"repoUrl":24,"updatedAt":6028},"map application topology from APM telemetry","Map the application topology from APM telemetry — which services call which, over what protocols, with what call volume and latency. Use when the user asks \"what calls X\", \"what depends on X\", \"show me the topology\", \"what are the upstream\u002Fdownstream services\", \"where does this service fit\", or is doing root-cause investigation and needs to trace how a problem propagates through the call graph. Also trigger for \"service map\", \"dependency graph\", \"blast radius of service X\", or \"who's the dependency of Y\". Requires Elastic APM — do not trigger for log-only or metrics-only customers.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6024,6025,6026,6027],{"name":6013,"slug":6014,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:49:23.167442",{"slug":5747,"name":5747,"fn":6030,"description":6031,"org":6032,"tags":6033,"stars":23,"repoUrl":24,"updatedAt":6042},"assess Kubernetes node failure impact","Assess the impact of a Kubernetes node going offline — which deployments lose all replicas (full outage), which lose partial capacity (degraded), which are unaffected, and whether the cluster has enough spare capacity to reschedule the lost pods. Use when the user asks \"what happens if node X goes down\", \"what's the blast radius of draining this node\", \"can I safely maintain node Y\", \"what's running on this node\", \"if I evict this node what breaks\", or is planning node maintenance, a cluster upgrade, or investigating an actual node failure. Requires Kubernetes (kubeletstats metrics) and Elastic APM for downstream service impact — do not trigger for non-K8s deployments.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6034,6035,6038,6039],{"name":9,"slug":8,"type":15},{"name":6036,"slug":6037,"type":15},"Kubernetes","kubernetes",{"name":13,"slug":14,"type":15},{"name":6040,"slug":6041,"type":15},"Risk Assessment","risk-assessment","2026-07-12T07:49:25.645103",{"slug":58,"name":58,"fn":6044,"description":6045,"org":6046,"tags":6047,"stars":23,"repoUrl":24,"updatedAt":6056},"manage Kibana alerting rules","CRUD for Kibana alerting rules — create, list, get, or delete custom-threshold rules. Use when the user says \"alert me when\", \"create a rule for\", \"page me if\", \"set up an alert\", \"show me my rules\", \"what alerts do I have\", \"delete that alert\", \"remove the rule\". Backend-agnostic — works on any metric field in any index pattern (metrics-*, logs-*, traces-apm*, custom). For transient session-scoped monitoring use `observe` instead. Requires Kibana with the Alerting feature enabled — the tool is auto-disabled when no Kibana URL is configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6048,6051,6052,6055],{"name":6049,"slug":6050,"type":15},"Alerting","alerting",{"name":9,"slug":8,"type":15},{"name":6053,"slug":6054,"type":15},"Kibana","kibana",{"name":17,"slug":18,"type":15},"2026-07-12T07:49:21.846108",{"slug":5560,"name":5560,"fn":6058,"description":6059,"org":6060,"tags":6061,"stars":23,"repoUrl":24,"updatedAt":6070},"query Elastic ML anomaly detection results","Query Elastic ML anomaly detection results to understand what's behaving unusually, why, and how badly. Use when the user asks \"what's anomalous\", \"is anything unusual happening\", \"why is X slow\u002Fspiking\", \"show me the weirdness\", or mentions memory growth, CPU spikes, restart patterns, unusual latency, unexpected error rates, or drift from typical behavior. Also trigger for \"ML anomalies\", \"anomaly detection\", \"Elastic ML\", \"what does ML think\", or when the user wants to understand behavior that deviates from baseline. The tool opens an inline explainer view with a severity gauge, plain-English narrative, and per-entity deviation breakdown — so the agent should USE the visualization, not just dump JSON.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6062,6065,6066,6069],{"name":6063,"slug":6064,"type":15},"Anomaly Detection","anomaly-detection",{"name":9,"slug":8,"type":15},{"name":6067,"slug":6068,"type":15},"Machine Learning","machine-learning",{"name":13,"slug":14,"type":15},"2026-07-12T07:49:26.869446",{"slug":4,"name":4,"fn":5,"description":6,"org":6072,"tags":6073,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6074,6075,6076,6077],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"items":6079,"total":6251},[6080,6099,6116,6131,6150,6162,6172,6187,6199,6214,6225,6238],{"slug":6081,"name":6081,"fn":6082,"description":6083,"org":6084,"tags":6085,"stars":6096,"repoUrl":6097,"updatedAt":6098},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6086,6089,6092,6093],{"name":6087,"slug":6088,"type":15},"Analytics","analytics",{"name":6090,"slug":6091,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":6094,"slug":6095,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":6100,"name":6100,"fn":6101,"description":6102,"org":6103,"tags":6104,"stars":6096,"repoUrl":6097,"updatedAt":6115},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6105,6108,6109,6112],{"name":6106,"slug":6107,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":6110,"slug":6111,"type":15},"Engineering","engineering",{"name":6113,"slug":6114,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":6117,"name":6117,"fn":6118,"description":6119,"org":6120,"tags":6121,"stars":6096,"repoUrl":6097,"updatedAt":6130},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6122,6123,6126,6127],{"name":9,"slug":8,"type":15},{"name":6124,"slug":6125,"type":15},"Elasticsearch","elasticsearch",{"name":6094,"slug":6095,"type":15},{"name":6128,"slug":6129,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":6132,"name":6132,"fn":6133,"description":6134,"org":6135,"tags":6136,"stars":6147,"repoUrl":6148,"updatedAt":6149},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6137,6140,6141,6144],{"name":6138,"slug":6139,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":6142,"slug":6143,"type":15},"Operations","operations",{"name":6145,"slug":6146,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":6151,"name":6151,"fn":6152,"description":6153,"org":6154,"tags":6155,"stars":6147,"repoUrl":6148,"updatedAt":6161},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6156,6157,6160],{"name":6138,"slug":6139,"type":15},{"name":6158,"slug":6159,"type":15},"Deployment","deployment",{"name":6124,"slug":6125,"type":15},"2026-07-12T07:46:42.353362",{"slug":6163,"name":6163,"fn":6164,"description":6165,"org":6166,"tags":6167,"stars":6147,"repoUrl":6148,"updatedAt":6171},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6168,6169,6170],{"name":6138,"slug":6139,"type":15},{"name":6124,"slug":6125,"type":15},{"name":6142,"slug":6143,"type":15},"2026-07-12T07:46:41.097412",{"slug":6173,"name":6173,"fn":6174,"description":6175,"org":6176,"tags":6177,"stars":6147,"repoUrl":6148,"updatedAt":6186},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6178,6179,6180,6183],{"name":6138,"slug":6139,"type":15},{"name":6124,"slug":6125,"type":15},{"name":6181,"slug":6182,"type":15},"Networking","networking",{"name":6184,"slug":6185,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":6188,"name":6188,"fn":6189,"description":6190,"org":6191,"tags":6192,"stars":6147,"repoUrl":6148,"updatedAt":6198},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6193,6196,6197],{"name":6194,"slug":6195,"type":15},"Authentication","authentication",{"name":6138,"slug":6139,"type":15},{"name":6124,"slug":6125,"type":15},"2026-07-12T07:46:39.783105",{"slug":6200,"name":6200,"fn":6201,"description":6202,"org":6203,"tags":6204,"stars":6147,"repoUrl":6148,"updatedAt":6213},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6205,6208,6209,6212],{"name":6206,"slug":6207,"type":15},"Audit","audit",{"name":6124,"slug":6125,"type":15},{"name":6210,"slug":6211,"type":15},"Logs","logs",{"name":6184,"slug":6185,"type":15},"2026-07-12T07:47:35.092599",{"slug":6215,"name":6215,"fn":6216,"description":6217,"org":6218,"tags":6219,"stars":6147,"repoUrl":6148,"updatedAt":6224},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6220,6221,6222,6223],{"name":6194,"slug":6195,"type":15},{"name":9,"slug":8,"type":15},{"name":6124,"slug":6125,"type":15},{"name":6184,"slug":6185,"type":15},"2026-07-12T07:47:41.474547",{"slug":6226,"name":6226,"fn":6227,"description":6228,"org":6229,"tags":6230,"stars":6147,"repoUrl":6148,"updatedAt":6237},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6231,6232,6233,6236],{"name":9,"slug":8,"type":15},{"name":6124,"slug":6125,"type":15},{"name":6234,"slug":6235,"type":15},"RBAC","rbac",{"name":6184,"slug":6185,"type":15},"2026-07-12T07:47:36.394177",{"slug":6239,"name":6239,"fn":6240,"description":6241,"org":6242,"tags":6243,"stars":6147,"repoUrl":6148,"updatedAt":6250},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6244,6245,6246,6247],{"name":6087,"slug":6088,"type":15},{"name":6090,"slug":6091,"type":15},{"name":6124,"slug":6125,"type":15},{"name":6248,"slug":6249,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]