[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-package-spec":3,"mdc--s9wdd2-key":34,"related-repo-elastic-package-spec":1463,"related-org-elastic-package-spec":1567},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"package-spec","ensure Elastic package specification compliance","Package specification compliance for Elastic integration packages. Covers manifest structure (format_version, conditions, variables, routing rules), changelog schema and semantic version bumps, and alignment with the upstream elastic\u002Fpackage-spec. Use when building or reviewing manifest.yml, changelog.yml, or debugging elastic-package lint\u002Fcheck errors on package metadata.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Packaging","packaging","tag",{"name":17,"slug":18,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},"Integrations","integrations",{"name":9,"slug":8,"type":15},11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-12T07:47:03.988448","Apache-2.0",2,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fpackage-spec","---\nname: package-spec\ndescription: >-\n  Package specification compliance for Elastic integration packages. Covers\n  manifest structure (format_version, conditions, variables, routing rules),\n  changelog schema and semantic version bumps, and alignment with the upstream\n  elastic\u002Fpackage-spec. Use when building or reviewing manifest.yml, changelog.yml,\n  or debugging elastic-package lint\u002Fcheck errors on package metadata.\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\nsynced_from: sit-llm\u002Fknowledge\u002Fskills\u002Fmanifest\u002F\n---\n\n# package-spec\n\n## Skill authority\n\nThe rules and patterns defined in this skill and its reference files are the **authoritative source of truth**. When examining existing integrations in the `elastic\u002Fintegrations` repository for reference, you may encounter patterns that conflict with what is specified here -- many integrations contain legacy patterns that predate current standards. **Always follow this skill over patterns observed in other integrations.** If a reference integration uses a deprecated or prohibited pattern, do not copy it.\n\n## When to use\n\nUse this skill when tasks include:\n- building or reviewing `manifest.yml` at root or data stream level\n- adding or validating `changelog.yml` entries\n- selecting the correct change type and semantic version bump\n- configuring policy templates, inputs, and variable declarations\n- debugging `elastic-package lint` or `elastic-package check` errors on manifests or changelogs\n- reviewing variable scoping across package, policy template, input, and data stream levels\n- validating Handlebars template variables against manifest declarations\n- configuring routing rules and their required manifest flags\n- determining which `format_version` is needed for a package's features\n\n## When NOT to use\n\n- Package scaffolding and directory layout (`create-integration`)\n- Ingest pipeline design (`ingest-pipelines`)\n- Field mapping and ECS compliance (`ecs-field-mappings`)\n- CEL programs (`cel-programs`)\n- Transform configuration (see `review-integration` skill's `references\u002Ftransform-guide.md`)\n\n## Handoff\n\nFor package directory layout and required files, see `create-integration` -> `references\u002Fpackage-layout.md`. For `elastic-package` CLI commands and troubleshooting, see `elastic-package-cli`.\n\n---\n\n## format_version\n\nThe `format_version` field in `manifest.yml` declares which [elastic\u002Fpackage-spec](https:\u002F\u002Fgithub.com\u002Felastic\u002Fpackage-spec) version the package conforms to. The current standard for new packages is `\"3.4.2\"`.\n\n**Use the minimum version that supports the features the package actually uses**, not the latest available spec version. Bumping without needing new features:\n- forces users to run a newer Kibana than necessary\n- breaks backward compatibility for no reason\n- makes it harder to determine which features the package depends on\n\nOnly bump when the package uses a feature introduced in a newer spec version:\n\n| Feature | Minimum format_version |\n|---------|----------------------|\n| Basic package structure | 1.0.0 |\n| Input-level variables | 2.0.0 |\n| `elasticsearch.privileges` | 2.3.0 |\n| `routing_rules.yml` support | 2.9.0 |\n| `lifecycle` field | 3.0.0 |\n| Secret variables (`secret: true`) | 3.0.0 |\n| `elasticsearch.source_mode` | 3.0.3 |\n\nSee `references\u002Fformat-version-features.md` for the full feature-to-version table including recent spec additions (3.6.0+), and `references\u002Fmanifest-rules.md` for the review procedure.\n\n---\n\n## conditions.kibana.version\n\nThe current standard constraint is `\"^8.19.0 || ^9.1.0\"`. This is set in the **root** `manifest.yml` only -- data stream manifests must NOT set their own `conditions`.\n\nWhen an integration uses features that require a newer agent (e.g., CEL functions introduced in v9.3.0), the constraint must be adjusted accordingly. For systematic version verification of CEL features, see the `review-integration` skill's version check references.\n\n---\n\n## Variable scoping\n\nFleet variables exist at four levels:\n\n1. **Package level** -- `manifest.yml` top-level `vars:`\n2. **Policy template level** -- `manifest.yml` under `policy_templates[].vars:`\n3. **Input level** -- `manifest.yml` under `policy_templates[].inputs[].vars:`\n4. **Data stream level** -- `data_stream\u002F*\u002Fmanifest.yml` under `streams[].vars:`\n\nA variable declared in an inner scope **must not** reuse the name of a variable in an outer scope. This is variable shadowing and is rejected by `elastic-package` validation.\n\nSee `references\u002Fmanifest-rules.md` -> **Variable shadowing** for full rules, examples, and common patterns.\n\n---\n\n## Manifest rules (brief)\n\n- **Every Handlebars `{{var}}` must be declared in a manifest** -- undeclared variables silently resolve to empty strings. Handlebars helpers (`{{#if}}`, `{{#each}}`, `{{#unless}}`, `{{#contains}}`) and built-in variables (`{{data_stream.type}}`, `{{data_stream.dataset}}`, `{{data_stream.namespace}}`, `{{output}}`) are exempt.\n\n- **Routing rules require dynamic flags** -- when a data stream uses `routing_rules.yml`, the data stream manifest must declare `elasticsearch.dynamic_dataset: true` and `elasticsearch.dynamic_namespace: true`.\n\n- **Use proper YAML nesting, not dotted keys** -- `elasticsearch.dynamic_dataset` as a literal key name creates a single flat key, not a nested object. Use nested `elasticsearch:` -> `dynamic_dataset:` structure.\n\nSee `references\u002Fmanifest-rules.md` for complete rules, correct\u002Fincorrect examples, and the review checklist.\n\n---\n\n## Changelog schema\n\n`changelog.yml` is a version-grouped array; newer versions go on top:\n\n```yaml\n- version: \"1.2.0\"\n  changes:\n    - description: Added example parsing for edge-case payloads.\n      type: enhancement\n      link: https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegrations\u002Fpull\u002F12345\n```\n\nEach entry requires `description`, `type`, and `link`. Valid types: `enhancement`, `bugfix`, `breaking-change`.\n\n## Version bump rules\n\n- **patch** (`x.y.Z`): bug fixes and low-risk fixes\n- **minor** (`x.Y.z`): new content -- new data streams, new fields, new features\n- **major** (`X.y.z`): breaking changes -- field type changes or removals on existing integrations, ECS mapping conflicts, required config\u002Fauth changes that break existing policies, data stream restructuring, default behavior changes that alter collected or normalized data\n\n## Adding changelog entries\n\nEdit `changelog.yml` directly, or use `elastic-package changelog add` (see `elastic-package-cli` skill for command flags and `--next patch|minor|major` usage).\n\n## Common changelog pitfalls\n\n- Adding the entry under the wrong version or not at the top\n- Missing `link` field -- `elastic-package lint` validates that the PR\u002Fissue number is a positive integer and **rejects** `pull\u002F0`; use a real PR number or `pull\u002F99999` as a development placeholder and replace before merge\n- Bumping manifest\u002Fpackage version inconsistently with changelog intent\n\nSee `references\u002Fchangelog-patterns.md` for detailed patterns, breaking-change checklist, and CI examples.\n\n---\n\n## Upstream: elastic\u002Fpackage-spec\n\nThe [elastic\u002Fpackage-spec](https:\u002F\u002Fgithub.com\u002Felastic\u002Fpackage-spec) repository is the upstream authority for package structure, manifest schema, and validation rules. The `spec\u002Fchangelog.yml` in that repo documents which features were added in each spec version.\n\nKey points from the package-spec versioning model:\n- Packages must specify `format_version` in root `manifest.yml`\n- A package at `format_version: x.y.z` must be valid against specs in the range `[x.y.z, X.0.0)` where `X = x + 1`\n- Patch versions may add stricter validations (e.g., 3.6.0 added pipeline tag and on_failure validation)\n- Minor versions add new feature support\n- Major versions are reserved for significant format changes\n\nSee `references\u002Fformat-version-features.md` for the curated feature-to-version table.\n\n## Reference files\n\n| File | Contains |\n|------|----------|\n| `references\u002Fmanifest-rules.md` | Full rules for format_version selection, variable shadowing, Handlebars variable declarations, routing rules, YAML structure, and severity-tagged review checklist |\n| `references\u002Fchangelog-patterns.md` | Changelog entry patterns, semver rules, breaking-change checklist, CI examples |\n| `references\u002Fformat-version-features.md` | Feature-to-version table sourced from elastic\u002Fpackage-spec, including recent spec additions |\n",{"data":35,"body":39},{"name":4,"description":6,"license":26,"metadata":36,"synced_from":38},{"author":8,"version":37},"1.0","sit-llm\u002Fknowledge\u002Fskills\u002Fmanifest\u002F",{"type":40,"children":41},"root",[42,49,56,86,92,97,187,193,265,271,307,311,315,352,362,380,385,530,551,554,560,593,605,608,614,619,711,730,747,750,756,900,911,914,920,930,1052,1101,1107,1162,1168,1203,1209,1263,1275,1278,1284,1303,1308,1370,1381,1387,1457],{"type":43,"tag":44,"props":45,"children":46},"element","h1",{"id":4},[47],{"type":48,"value":4},"text",{"type":43,"tag":50,"props":51,"children":53},"h2",{"id":52},"skill-authority",[54],{"type":48,"value":55},"Skill authority",{"type":43,"tag":57,"props":58,"children":59},"p",{},[60,62,68,70,77,79,84],{"type":48,"value":61},"The rules and patterns defined in this skill and its reference files are the ",{"type":43,"tag":63,"props":64,"children":65},"strong",{},[66],{"type":48,"value":67},"authoritative source of truth",{"type":48,"value":69},". When examining existing integrations in the ",{"type":43,"tag":71,"props":72,"children":74},"code",{"className":73},[],[75],{"type":48,"value":76},"elastic\u002Fintegrations",{"type":48,"value":78}," repository for reference, you may encounter patterns that conflict with what is specified here -- many integrations contain legacy patterns that predate current standards. ",{"type":43,"tag":63,"props":80,"children":81},{},[82],{"type":48,"value":83},"Always follow this skill over patterns observed in other integrations.",{"type":48,"value":85}," If a reference integration uses a deprecated or prohibited pattern, do not copy it.",{"type":43,"tag":50,"props":87,"children":89},{"id":88},"when-to-use",[90],{"type":48,"value":91},"When to use",{"type":43,"tag":57,"props":93,"children":94},{},[95],{"type":48,"value":96},"Use this skill when tasks include:",{"type":43,"tag":98,"props":99,"children":100},"ul",{},[101,115,128,133,138,159,164,169,174],{"type":43,"tag":102,"props":103,"children":104},"li",{},[105,107,113],{"type":48,"value":106},"building or reviewing ",{"type":43,"tag":71,"props":108,"children":110},{"className":109},[],[111],{"type":48,"value":112},"manifest.yml",{"type":48,"value":114}," at root or data stream level",{"type":43,"tag":102,"props":116,"children":117},{},[118,120,126],{"type":48,"value":119},"adding or validating ",{"type":43,"tag":71,"props":121,"children":123},{"className":122},[],[124],{"type":48,"value":125},"changelog.yml",{"type":48,"value":127}," entries",{"type":43,"tag":102,"props":129,"children":130},{},[131],{"type":48,"value":132},"selecting the correct change type and semantic version bump",{"type":43,"tag":102,"props":134,"children":135},{},[136],{"type":48,"value":137},"configuring policy templates, inputs, and variable declarations",{"type":43,"tag":102,"props":139,"children":140},{},[141,143,149,151,157],{"type":48,"value":142},"debugging ",{"type":43,"tag":71,"props":144,"children":146},{"className":145},[],[147],{"type":48,"value":148},"elastic-package lint",{"type":48,"value":150}," or ",{"type":43,"tag":71,"props":152,"children":154},{"className":153},[],[155],{"type":48,"value":156},"elastic-package check",{"type":48,"value":158}," errors on manifests or changelogs",{"type":43,"tag":102,"props":160,"children":161},{},[162],{"type":48,"value":163},"reviewing variable scoping across package, policy template, input, and data stream levels",{"type":43,"tag":102,"props":165,"children":166},{},[167],{"type":48,"value":168},"validating Handlebars template variables against manifest declarations",{"type":43,"tag":102,"props":170,"children":171},{},[172],{"type":48,"value":173},"configuring routing rules and their required manifest flags",{"type":43,"tag":102,"props":175,"children":176},{},[177,179,185],{"type":48,"value":178},"determining which ",{"type":43,"tag":71,"props":180,"children":182},{"className":181},[],[183],{"type":48,"value":184},"format_version",{"type":48,"value":186}," is needed for a package's features",{"type":43,"tag":50,"props":188,"children":190},{"id":189},"when-not-to-use",[191],{"type":48,"value":192},"When NOT to use",{"type":43,"tag":98,"props":194,"children":195},{},[196,209,221,233,245],{"type":43,"tag":102,"props":197,"children":198},{},[199,201,207],{"type":48,"value":200},"Package scaffolding and directory layout (",{"type":43,"tag":71,"props":202,"children":204},{"className":203},[],[205],{"type":48,"value":206},"create-integration",{"type":48,"value":208},")",{"type":43,"tag":102,"props":210,"children":211},{},[212,214,220],{"type":48,"value":213},"Ingest pipeline design (",{"type":43,"tag":71,"props":215,"children":217},{"className":216},[],[218],{"type":48,"value":219},"ingest-pipelines",{"type":48,"value":208},{"type":43,"tag":102,"props":222,"children":223},{},[224,226,232],{"type":48,"value":225},"Field mapping and ECS compliance (",{"type":43,"tag":71,"props":227,"children":229},{"className":228},[],[230],{"type":48,"value":231},"ecs-field-mappings",{"type":48,"value":208},{"type":43,"tag":102,"props":234,"children":235},{},[236,238,244],{"type":48,"value":237},"CEL programs (",{"type":43,"tag":71,"props":239,"children":241},{"className":240},[],[242],{"type":48,"value":243},"cel-programs",{"type":48,"value":208},{"type":43,"tag":102,"props":246,"children":247},{},[248,250,256,258,264],{"type":48,"value":249},"Transform configuration (see ",{"type":43,"tag":71,"props":251,"children":253},{"className":252},[],[254],{"type":48,"value":255},"review-integration",{"type":48,"value":257}," skill's ",{"type":43,"tag":71,"props":259,"children":261},{"className":260},[],[262],{"type":48,"value":263},"references\u002Ftransform-guide.md",{"type":48,"value":208},{"type":43,"tag":50,"props":266,"children":268},{"id":267},"handoff",[269],{"type":48,"value":270},"Handoff",{"type":43,"tag":57,"props":272,"children":273},{},[274,276,281,283,289,291,297,299,305],{"type":48,"value":275},"For package directory layout and required files, see ",{"type":43,"tag":71,"props":277,"children":279},{"className":278},[],[280],{"type":48,"value":206},{"type":48,"value":282}," -> ",{"type":43,"tag":71,"props":284,"children":286},{"className":285},[],[287],{"type":48,"value":288},"references\u002Fpackage-layout.md",{"type":48,"value":290},". For ",{"type":43,"tag":71,"props":292,"children":294},{"className":293},[],[295],{"type":48,"value":296},"elastic-package",{"type":48,"value":298}," CLI commands and troubleshooting, see ",{"type":43,"tag":71,"props":300,"children":302},{"className":301},[],[303],{"type":48,"value":304},"elastic-package-cli",{"type":48,"value":306},".",{"type":43,"tag":308,"props":309,"children":310},"hr",{},[],{"type":43,"tag":50,"props":312,"children":313},{"id":184},[314],{"type":48,"value":184},{"type":43,"tag":57,"props":316,"children":317},{},[318,320,325,327,332,334,343,345,351],{"type":48,"value":319},"The ",{"type":43,"tag":71,"props":321,"children":323},{"className":322},[],[324],{"type":48,"value":184},{"type":48,"value":326}," field in ",{"type":43,"tag":71,"props":328,"children":330},{"className":329},[],[331],{"type":48,"value":112},{"type":48,"value":333}," declares which ",{"type":43,"tag":335,"props":336,"children":340},"a",{"href":337,"rel":338},"https:\u002F\u002Fgithub.com\u002Felastic\u002Fpackage-spec",[339],"nofollow",[341],{"type":48,"value":342},"elastic\u002Fpackage-spec",{"type":48,"value":344}," version the package conforms to. The current standard for new packages is ",{"type":43,"tag":71,"props":346,"children":348},{"className":347},[],[349],{"type":48,"value":350},"\"3.4.2\"",{"type":48,"value":306},{"type":43,"tag":57,"props":353,"children":354},{},[355,360],{"type":43,"tag":63,"props":356,"children":357},{},[358],{"type":48,"value":359},"Use the minimum version that supports the features the package actually uses",{"type":48,"value":361},", not the latest available spec version. Bumping without needing new features:",{"type":43,"tag":98,"props":363,"children":364},{},[365,370,375],{"type":43,"tag":102,"props":366,"children":367},{},[368],{"type":48,"value":369},"forces users to run a newer Kibana than necessary",{"type":43,"tag":102,"props":371,"children":372},{},[373],{"type":48,"value":374},"breaks backward compatibility for no reason",{"type":43,"tag":102,"props":376,"children":377},{},[378],{"type":48,"value":379},"makes it harder to determine which features the package depends on",{"type":43,"tag":57,"props":381,"children":382},{},[383],{"type":48,"value":384},"Only bump when the package uses a feature introduced in a newer spec version:",{"type":43,"tag":386,"props":387,"children":388},"table",{},[389,408],{"type":43,"tag":390,"props":391,"children":392},"thead",{},[393],{"type":43,"tag":394,"props":395,"children":396},"tr",{},[397,403],{"type":43,"tag":398,"props":399,"children":400},"th",{},[401],{"type":48,"value":402},"Feature",{"type":43,"tag":398,"props":404,"children":405},{},[406],{"type":48,"value":407},"Minimum format_version",{"type":43,"tag":409,"props":410,"children":411},"tbody",{},[412,426,439,456,475,494,513],{"type":43,"tag":394,"props":413,"children":414},{},[415,421],{"type":43,"tag":416,"props":417,"children":418},"td",{},[419],{"type":48,"value":420},"Basic package structure",{"type":43,"tag":416,"props":422,"children":423},{},[424],{"type":48,"value":425},"1.0.0",{"type":43,"tag":394,"props":427,"children":428},{},[429,434],{"type":43,"tag":416,"props":430,"children":431},{},[432],{"type":48,"value":433},"Input-level variables",{"type":43,"tag":416,"props":435,"children":436},{},[437],{"type":48,"value":438},"2.0.0",{"type":43,"tag":394,"props":440,"children":441},{},[442,451],{"type":43,"tag":416,"props":443,"children":444},{},[445],{"type":43,"tag":71,"props":446,"children":448},{"className":447},[],[449],{"type":48,"value":450},"elasticsearch.privileges",{"type":43,"tag":416,"props":452,"children":453},{},[454],{"type":48,"value":455},"2.3.0",{"type":43,"tag":394,"props":457,"children":458},{},[459,470],{"type":43,"tag":416,"props":460,"children":461},{},[462,468],{"type":43,"tag":71,"props":463,"children":465},{"className":464},[],[466],{"type":48,"value":467},"routing_rules.yml",{"type":48,"value":469}," support",{"type":43,"tag":416,"props":471,"children":472},{},[473],{"type":48,"value":474},"2.9.0",{"type":43,"tag":394,"props":476,"children":477},{},[478,489],{"type":43,"tag":416,"props":479,"children":480},{},[481,487],{"type":43,"tag":71,"props":482,"children":484},{"className":483},[],[485],{"type":48,"value":486},"lifecycle",{"type":48,"value":488}," field",{"type":43,"tag":416,"props":490,"children":491},{},[492],{"type":48,"value":493},"3.0.0",{"type":43,"tag":394,"props":495,"children":496},{},[497,509],{"type":43,"tag":416,"props":498,"children":499},{},[500,502,508],{"type":48,"value":501},"Secret variables (",{"type":43,"tag":71,"props":503,"children":505},{"className":504},[],[506],{"type":48,"value":507},"secret: true",{"type":48,"value":208},{"type":43,"tag":416,"props":510,"children":511},{},[512],{"type":48,"value":493},{"type":43,"tag":394,"props":514,"children":515},{},[516,525],{"type":43,"tag":416,"props":517,"children":518},{},[519],{"type":43,"tag":71,"props":520,"children":522},{"className":521},[],[523],{"type":48,"value":524},"elasticsearch.source_mode",{"type":43,"tag":416,"props":526,"children":527},{},[528],{"type":48,"value":529},"3.0.3",{"type":43,"tag":57,"props":531,"children":532},{},[533,535,541,543,549],{"type":48,"value":534},"See ",{"type":43,"tag":71,"props":536,"children":538},{"className":537},[],[539],{"type":48,"value":540},"references\u002Fformat-version-features.md",{"type":48,"value":542}," for the full feature-to-version table including recent spec additions (3.6.0+), and ",{"type":43,"tag":71,"props":544,"children":546},{"className":545},[],[547],{"type":48,"value":548},"references\u002Fmanifest-rules.md",{"type":48,"value":550}," for the review procedure.",{"type":43,"tag":308,"props":552,"children":553},{},[],{"type":43,"tag":50,"props":555,"children":557},{"id":556},"conditionskibanaversion",[558],{"type":48,"value":559},"conditions.kibana.version",{"type":43,"tag":57,"props":561,"children":562},{},[563,565,571,573,577,579,584,586,592],{"type":48,"value":564},"The current standard constraint is ",{"type":43,"tag":71,"props":566,"children":568},{"className":567},[],[569],{"type":48,"value":570},"\"^8.19.0 || ^9.1.0\"",{"type":48,"value":572},". This is set in the ",{"type":43,"tag":63,"props":574,"children":575},{},[576],{"type":48,"value":40},{"type":48,"value":578}," ",{"type":43,"tag":71,"props":580,"children":582},{"className":581},[],[583],{"type":48,"value":112},{"type":48,"value":585}," only -- data stream manifests must NOT set their own ",{"type":43,"tag":71,"props":587,"children":589},{"className":588},[],[590],{"type":48,"value":591},"conditions",{"type":48,"value":306},{"type":43,"tag":57,"props":594,"children":595},{},[596,598,603],{"type":48,"value":597},"When an integration uses features that require a newer agent (e.g., CEL functions introduced in v9.3.0), the constraint must be adjusted accordingly. For systematic version verification of CEL features, see the ",{"type":43,"tag":71,"props":599,"children":601},{"className":600},[],[602],{"type":48,"value":255},{"type":48,"value":604}," skill's version check references.",{"type":43,"tag":308,"props":606,"children":607},{},[],{"type":43,"tag":50,"props":609,"children":611},{"id":610},"variable-scoping",[612],{"type":48,"value":613},"Variable scoping",{"type":43,"tag":57,"props":615,"children":616},{},[617],{"type":48,"value":618},"Fleet variables exist at four levels:",{"type":43,"tag":620,"props":621,"children":622},"ol",{},[623,646,668,689],{"type":43,"tag":102,"props":624,"children":625},{},[626,631,633,638,640],{"type":43,"tag":63,"props":627,"children":628},{},[629],{"type":48,"value":630},"Package level",{"type":48,"value":632}," -- ",{"type":43,"tag":71,"props":634,"children":636},{"className":635},[],[637],{"type":48,"value":112},{"type":48,"value":639}," top-level ",{"type":43,"tag":71,"props":641,"children":643},{"className":642},[],[644],{"type":48,"value":645},"vars:",{"type":43,"tag":102,"props":647,"children":648},{},[649,654,655,660,662],{"type":43,"tag":63,"props":650,"children":651},{},[652],{"type":48,"value":653},"Policy template level",{"type":48,"value":632},{"type":43,"tag":71,"props":656,"children":658},{"className":657},[],[659],{"type":48,"value":112},{"type":48,"value":661}," under ",{"type":43,"tag":71,"props":663,"children":665},{"className":664},[],[666],{"type":48,"value":667},"policy_templates[].vars:",{"type":43,"tag":102,"props":669,"children":670},{},[671,676,677,682,683],{"type":43,"tag":63,"props":672,"children":673},{},[674],{"type":48,"value":675},"Input level",{"type":48,"value":632},{"type":43,"tag":71,"props":678,"children":680},{"className":679},[],[681],{"type":48,"value":112},{"type":48,"value":661},{"type":43,"tag":71,"props":684,"children":686},{"className":685},[],[687],{"type":48,"value":688},"policy_templates[].inputs[].vars:",{"type":43,"tag":102,"props":690,"children":691},{},[692,697,698,704,705],{"type":43,"tag":63,"props":693,"children":694},{},[695],{"type":48,"value":696},"Data stream level",{"type":48,"value":632},{"type":43,"tag":71,"props":699,"children":701},{"className":700},[],[702],{"type":48,"value":703},"data_stream\u002F*\u002Fmanifest.yml",{"type":48,"value":661},{"type":43,"tag":71,"props":706,"children":708},{"className":707},[],[709],{"type":48,"value":710},"streams[].vars:",{"type":43,"tag":57,"props":712,"children":713},{},[714,716,721,723,728],{"type":48,"value":715},"A variable declared in an inner scope ",{"type":43,"tag":63,"props":717,"children":718},{},[719],{"type":48,"value":720},"must not",{"type":48,"value":722}," reuse the name of a variable in an outer scope. This is variable shadowing and is rejected by ",{"type":43,"tag":71,"props":724,"children":726},{"className":725},[],[727],{"type":48,"value":296},{"type":48,"value":729}," validation.",{"type":43,"tag":57,"props":731,"children":732},{},[733,734,739,740,745],{"type":48,"value":534},{"type":43,"tag":71,"props":735,"children":737},{"className":736},[],[738],{"type":48,"value":548},{"type":48,"value":282},{"type":43,"tag":63,"props":741,"children":742},{},[743],{"type":48,"value":744},"Variable shadowing",{"type":48,"value":746}," for full rules, examples, and common patterns.",{"type":43,"tag":308,"props":748,"children":749},{},[],{"type":43,"tag":50,"props":751,"children":753},{"id":752},"manifest-rules-brief",[754],{"type":48,"value":755},"Manifest rules (brief)",{"type":43,"tag":98,"props":757,"children":758},{},[759,836,868],{"type":43,"tag":102,"props":760,"children":761},{},[762,775,777,783,785,791,792,798,799,805,807,813,814,820,821,827,828,834],{"type":43,"tag":63,"props":763,"children":764},{},[765,767,773],{"type":48,"value":766},"Every Handlebars ",{"type":43,"tag":71,"props":768,"children":770},{"className":769},[],[771],{"type":48,"value":772},"{{var}}",{"type":48,"value":774}," must be declared in a manifest",{"type":48,"value":776}," -- undeclared variables silently resolve to empty strings. Handlebars helpers (",{"type":43,"tag":71,"props":778,"children":780},{"className":779},[],[781],{"type":48,"value":782},"{{#if}}",{"type":48,"value":784},", ",{"type":43,"tag":71,"props":786,"children":788},{"className":787},[],[789],{"type":48,"value":790},"{{#each}}",{"type":48,"value":784},{"type":43,"tag":71,"props":793,"children":795},{"className":794},[],[796],{"type":48,"value":797},"{{#unless}}",{"type":48,"value":784},{"type":43,"tag":71,"props":800,"children":802},{"className":801},[],[803],{"type":48,"value":804},"{{#contains}}",{"type":48,"value":806},") and built-in variables (",{"type":43,"tag":71,"props":808,"children":810},{"className":809},[],[811],{"type":48,"value":812},"{{data_stream.type}}",{"type":48,"value":784},{"type":43,"tag":71,"props":815,"children":817},{"className":816},[],[818],{"type":48,"value":819},"{{data_stream.dataset}}",{"type":48,"value":784},{"type":43,"tag":71,"props":822,"children":824},{"className":823},[],[825],{"type":48,"value":826},"{{data_stream.namespace}}",{"type":48,"value":784},{"type":43,"tag":71,"props":829,"children":831},{"className":830},[],[832],{"type":48,"value":833},"{{output}}",{"type":48,"value":835},") are exempt.",{"type":43,"tag":102,"props":837,"children":838},{},[839,844,846,851,853,859,861,867],{"type":43,"tag":63,"props":840,"children":841},{},[842],{"type":48,"value":843},"Routing rules require dynamic flags",{"type":48,"value":845}," -- when a data stream uses ",{"type":43,"tag":71,"props":847,"children":849},{"className":848},[],[850],{"type":48,"value":467},{"type":48,"value":852},", the data stream manifest must declare ",{"type":43,"tag":71,"props":854,"children":856},{"className":855},[],[857],{"type":48,"value":858},"elasticsearch.dynamic_dataset: true",{"type":48,"value":860}," and ",{"type":43,"tag":71,"props":862,"children":864},{"className":863},[],[865],{"type":48,"value":866},"elasticsearch.dynamic_namespace: true",{"type":48,"value":306},{"type":43,"tag":102,"props":869,"children":870},{},[871,876,877,883,885,891,892,898],{"type":43,"tag":63,"props":872,"children":873},{},[874],{"type":48,"value":875},"Use proper YAML nesting, not dotted keys",{"type":48,"value":632},{"type":43,"tag":71,"props":878,"children":880},{"className":879},[],[881],{"type":48,"value":882},"elasticsearch.dynamic_dataset",{"type":48,"value":884}," as a literal key name creates a single flat key, not a nested object. Use nested ",{"type":43,"tag":71,"props":886,"children":888},{"className":887},[],[889],{"type":48,"value":890},"elasticsearch:",{"type":48,"value":282},{"type":43,"tag":71,"props":893,"children":895},{"className":894},[],[896],{"type":48,"value":897},"dynamic_dataset:",{"type":48,"value":899}," structure.",{"type":43,"tag":57,"props":901,"children":902},{},[903,904,909],{"type":48,"value":534},{"type":43,"tag":71,"props":905,"children":907},{"className":906},[],[908],{"type":48,"value":548},{"type":48,"value":910}," for complete rules, correct\u002Fincorrect examples, and the review checklist.",{"type":43,"tag":308,"props":912,"children":913},{},[],{"type":43,"tag":50,"props":915,"children":917},{"id":916},"changelog-schema",[918],{"type":48,"value":919},"Changelog schema",{"type":43,"tag":57,"props":921,"children":922},{},[923,928],{"type":43,"tag":71,"props":924,"children":926},{"className":925},[],[927],{"type":48,"value":125},{"type":48,"value":929}," is a version-grouped array; newer versions go on top:",{"type":43,"tag":931,"props":932,"children":937},"pre",{"className":933,"code":934,"language":935,"meta":936,"style":936},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","- version: \"1.2.0\"\n  changes:\n    - description: Added example parsing for edge-case payloads.\n      type: enhancement\n      link: https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegrations\u002Fpull\u002F12345\n","yaml","",[938],{"type":43,"tag":71,"props":939,"children":940},{"__ignoreMap":936},[941,980,993,1016,1034],{"type":43,"tag":942,"props":943,"children":946},"span",{"class":944,"line":945},"line",1,[947,953,959,964,969,975],{"type":43,"tag":942,"props":948,"children":950},{"style":949},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[951],{"type":48,"value":952},"-",{"type":43,"tag":942,"props":954,"children":956},{"style":955},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[957],{"type":48,"value":958}," version",{"type":43,"tag":942,"props":960,"children":961},{"style":949},[962],{"type":48,"value":963},":",{"type":43,"tag":942,"props":965,"children":966},{"style":949},[967],{"type":48,"value":968}," \"",{"type":43,"tag":942,"props":970,"children":972},{"style":971},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[973],{"type":48,"value":974},"1.2.0",{"type":43,"tag":942,"props":976,"children":977},{"style":949},[978],{"type":48,"value":979},"\"\n",{"type":43,"tag":942,"props":981,"children":982},{"class":944,"line":27},[983,988],{"type":43,"tag":942,"props":984,"children":985},{"style":955},[986],{"type":48,"value":987},"  changes",{"type":43,"tag":942,"props":989,"children":990},{"style":949},[991],{"type":48,"value":992},":\n",{"type":43,"tag":942,"props":994,"children":996},{"class":944,"line":995},3,[997,1002,1007,1011],{"type":43,"tag":942,"props":998,"children":999},{"style":949},[1000],{"type":48,"value":1001},"    -",{"type":43,"tag":942,"props":1003,"children":1004},{"style":955},[1005],{"type":48,"value":1006}," description",{"type":43,"tag":942,"props":1008,"children":1009},{"style":949},[1010],{"type":48,"value":963},{"type":43,"tag":942,"props":1012,"children":1013},{"style":971},[1014],{"type":48,"value":1015}," Added example parsing for edge-case payloads.\n",{"type":43,"tag":942,"props":1017,"children":1019},{"class":944,"line":1018},4,[1020,1025,1029],{"type":43,"tag":942,"props":1021,"children":1022},{"style":955},[1023],{"type":48,"value":1024},"      type",{"type":43,"tag":942,"props":1026,"children":1027},{"style":949},[1028],{"type":48,"value":963},{"type":43,"tag":942,"props":1030,"children":1031},{"style":971},[1032],{"type":48,"value":1033}," enhancement\n",{"type":43,"tag":942,"props":1035,"children":1037},{"class":944,"line":1036},5,[1038,1043,1047],{"type":43,"tag":942,"props":1039,"children":1040},{"style":955},[1041],{"type":48,"value":1042},"      link",{"type":43,"tag":942,"props":1044,"children":1045},{"style":949},[1046],{"type":48,"value":963},{"type":43,"tag":942,"props":1048,"children":1049},{"style":971},[1050],{"type":48,"value":1051}," https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegrations\u002Fpull\u002F12345\n",{"type":43,"tag":57,"props":1053,"children":1054},{},[1055,1057,1063,1064,1070,1072,1078,1080,1086,1087,1093,1094,1100],{"type":48,"value":1056},"Each entry requires ",{"type":43,"tag":71,"props":1058,"children":1060},{"className":1059},[],[1061],{"type":48,"value":1062},"description",{"type":48,"value":784},{"type":43,"tag":71,"props":1065,"children":1067},{"className":1066},[],[1068],{"type":48,"value":1069},"type",{"type":48,"value":1071},", and ",{"type":43,"tag":71,"props":1073,"children":1075},{"className":1074},[],[1076],{"type":48,"value":1077},"link",{"type":48,"value":1079},". Valid types: ",{"type":43,"tag":71,"props":1081,"children":1083},{"className":1082},[],[1084],{"type":48,"value":1085},"enhancement",{"type":48,"value":784},{"type":43,"tag":71,"props":1088,"children":1090},{"className":1089},[],[1091],{"type":48,"value":1092},"bugfix",{"type":48,"value":784},{"type":43,"tag":71,"props":1095,"children":1097},{"className":1096},[],[1098],{"type":48,"value":1099},"breaking-change",{"type":48,"value":306},{"type":43,"tag":50,"props":1102,"children":1104},{"id":1103},"version-bump-rules",[1105],{"type":48,"value":1106},"Version bump rules",{"type":43,"tag":98,"props":1108,"children":1109},{},[1110,1128,1145],{"type":43,"tag":102,"props":1111,"children":1112},{},[1113,1118,1120,1126],{"type":43,"tag":63,"props":1114,"children":1115},{},[1116],{"type":48,"value":1117},"patch",{"type":48,"value":1119}," (",{"type":43,"tag":71,"props":1121,"children":1123},{"className":1122},[],[1124],{"type":48,"value":1125},"x.y.Z",{"type":48,"value":1127},"): bug fixes and low-risk fixes",{"type":43,"tag":102,"props":1129,"children":1130},{},[1131,1136,1137,1143],{"type":43,"tag":63,"props":1132,"children":1133},{},[1134],{"type":48,"value":1135},"minor",{"type":48,"value":1119},{"type":43,"tag":71,"props":1138,"children":1140},{"className":1139},[],[1141],{"type":48,"value":1142},"x.Y.z",{"type":48,"value":1144},"): new content -- new data streams, new fields, new features",{"type":43,"tag":102,"props":1146,"children":1147},{},[1148,1153,1154,1160],{"type":43,"tag":63,"props":1149,"children":1150},{},[1151],{"type":48,"value":1152},"major",{"type":48,"value":1119},{"type":43,"tag":71,"props":1155,"children":1157},{"className":1156},[],[1158],{"type":48,"value":1159},"X.y.z",{"type":48,"value":1161},"): breaking changes -- field type changes or removals on existing integrations, ECS mapping conflicts, required config\u002Fauth changes that break existing policies, data stream restructuring, default behavior changes that alter collected or normalized data",{"type":43,"tag":50,"props":1163,"children":1165},{"id":1164},"adding-changelog-entries",[1166],{"type":48,"value":1167},"Adding changelog entries",{"type":43,"tag":57,"props":1169,"children":1170},{},[1171,1173,1178,1180,1186,1188,1193,1195,1201],{"type":48,"value":1172},"Edit ",{"type":43,"tag":71,"props":1174,"children":1176},{"className":1175},[],[1177],{"type":48,"value":125},{"type":48,"value":1179}," directly, or use ",{"type":43,"tag":71,"props":1181,"children":1183},{"className":1182},[],[1184],{"type":48,"value":1185},"elastic-package changelog add",{"type":48,"value":1187}," (see ",{"type":43,"tag":71,"props":1189,"children":1191},{"className":1190},[],[1192],{"type":48,"value":304},{"type":48,"value":1194}," skill for command flags and ",{"type":43,"tag":71,"props":1196,"children":1198},{"className":1197},[],[1199],{"type":48,"value":1200},"--next patch|minor|major",{"type":48,"value":1202}," usage).",{"type":43,"tag":50,"props":1204,"children":1206},{"id":1205},"common-changelog-pitfalls",[1207],{"type":48,"value":1208},"Common changelog pitfalls",{"type":43,"tag":98,"props":1210,"children":1211},{},[1212,1217,1258],{"type":43,"tag":102,"props":1213,"children":1214},{},[1215],{"type":48,"value":1216},"Adding the entry under the wrong version or not at the top",{"type":43,"tag":102,"props":1218,"children":1219},{},[1220,1222,1227,1229,1234,1236,1241,1242,1248,1250,1256],{"type":48,"value":1221},"Missing ",{"type":43,"tag":71,"props":1223,"children":1225},{"className":1224},[],[1226],{"type":48,"value":1077},{"type":48,"value":1228}," field -- ",{"type":43,"tag":71,"props":1230,"children":1232},{"className":1231},[],[1233],{"type":48,"value":148},{"type":48,"value":1235}," validates that the PR\u002Fissue number is a positive integer and ",{"type":43,"tag":63,"props":1237,"children":1238},{},[1239],{"type":48,"value":1240},"rejects",{"type":48,"value":578},{"type":43,"tag":71,"props":1243,"children":1245},{"className":1244},[],[1246],{"type":48,"value":1247},"pull\u002F0",{"type":48,"value":1249},"; use a real PR number or ",{"type":43,"tag":71,"props":1251,"children":1253},{"className":1252},[],[1254],{"type":48,"value":1255},"pull\u002F99999",{"type":48,"value":1257}," as a development placeholder and replace before merge",{"type":43,"tag":102,"props":1259,"children":1260},{},[1261],{"type":48,"value":1262},"Bumping manifest\u002Fpackage version inconsistently with changelog intent",{"type":43,"tag":57,"props":1264,"children":1265},{},[1266,1267,1273],{"type":48,"value":534},{"type":43,"tag":71,"props":1268,"children":1270},{"className":1269},[],[1271],{"type":48,"value":1272},"references\u002Fchangelog-patterns.md",{"type":48,"value":1274}," for detailed patterns, breaking-change checklist, and CI examples.",{"type":43,"tag":308,"props":1276,"children":1277},{},[],{"type":43,"tag":50,"props":1279,"children":1281},{"id":1280},"upstream-elasticpackage-spec",[1282],{"type":48,"value":1283},"Upstream: elastic\u002Fpackage-spec",{"type":43,"tag":57,"props":1285,"children":1286},{},[1287,1288,1293,1295,1301],{"type":48,"value":319},{"type":43,"tag":335,"props":1289,"children":1291},{"href":337,"rel":1290},[339],[1292],{"type":48,"value":342},{"type":48,"value":1294}," repository is the upstream authority for package structure, manifest schema, and validation rules. The ",{"type":43,"tag":71,"props":1296,"children":1298},{"className":1297},[],[1299],{"type":48,"value":1300},"spec\u002Fchangelog.yml",{"type":48,"value":1302}," in that repo documents which features were added in each spec version.",{"type":43,"tag":57,"props":1304,"children":1305},{},[1306],{"type":48,"value":1307},"Key points from the package-spec versioning model:",{"type":43,"tag":98,"props":1309,"children":1310},{},[1311,1328,1355,1360,1365],{"type":43,"tag":102,"props":1312,"children":1313},{},[1314,1316,1321,1323],{"type":48,"value":1315},"Packages must specify ",{"type":43,"tag":71,"props":1317,"children":1319},{"className":1318},[],[1320],{"type":48,"value":184},{"type":48,"value":1322}," in root ",{"type":43,"tag":71,"props":1324,"children":1326},{"className":1325},[],[1327],{"type":48,"value":112},{"type":43,"tag":102,"props":1329,"children":1330},{},[1331,1333,1339,1341,1347,1349],{"type":48,"value":1332},"A package at ",{"type":43,"tag":71,"props":1334,"children":1336},{"className":1335},[],[1337],{"type":48,"value":1338},"format_version: x.y.z",{"type":48,"value":1340}," must be valid against specs in the range ",{"type":43,"tag":71,"props":1342,"children":1344},{"className":1343},[],[1345],{"type":48,"value":1346},"[x.y.z, X.0.0)",{"type":48,"value":1348}," where ",{"type":43,"tag":71,"props":1350,"children":1352},{"className":1351},[],[1353],{"type":48,"value":1354},"X = x + 1",{"type":43,"tag":102,"props":1356,"children":1357},{},[1358],{"type":48,"value":1359},"Patch versions may add stricter validations (e.g., 3.6.0 added pipeline tag and on_failure validation)",{"type":43,"tag":102,"props":1361,"children":1362},{},[1363],{"type":48,"value":1364},"Minor versions add new feature support",{"type":43,"tag":102,"props":1366,"children":1367},{},[1368],{"type":48,"value":1369},"Major versions are reserved for significant format changes",{"type":43,"tag":57,"props":1371,"children":1372},{},[1373,1374,1379],{"type":48,"value":534},{"type":43,"tag":71,"props":1375,"children":1377},{"className":1376},[],[1378],{"type":48,"value":540},{"type":48,"value":1380}," for the curated feature-to-version table.",{"type":43,"tag":50,"props":1382,"children":1384},{"id":1383},"reference-files",[1385],{"type":48,"value":1386},"Reference files",{"type":43,"tag":386,"props":1388,"children":1389},{},[1390,1406],{"type":43,"tag":390,"props":1391,"children":1392},{},[1393],{"type":43,"tag":394,"props":1394,"children":1395},{},[1396,1401],{"type":43,"tag":398,"props":1397,"children":1398},{},[1399],{"type":48,"value":1400},"File",{"type":43,"tag":398,"props":1402,"children":1403},{},[1404],{"type":48,"value":1405},"Contains",{"type":43,"tag":409,"props":1407,"children":1408},{},[1409,1425,1441],{"type":43,"tag":394,"props":1410,"children":1411},{},[1412,1420],{"type":43,"tag":416,"props":1413,"children":1414},{},[1415],{"type":43,"tag":71,"props":1416,"children":1418},{"className":1417},[],[1419],{"type":48,"value":548},{"type":43,"tag":416,"props":1421,"children":1422},{},[1423],{"type":48,"value":1424},"Full rules for format_version selection, variable shadowing, Handlebars variable declarations, routing rules, YAML structure, and severity-tagged review checklist",{"type":43,"tag":394,"props":1426,"children":1427},{},[1428,1436],{"type":43,"tag":416,"props":1429,"children":1430},{},[1431],{"type":43,"tag":71,"props":1432,"children":1434},{"className":1433},[],[1435],{"type":48,"value":1272},{"type":43,"tag":416,"props":1437,"children":1438},{},[1439],{"type":48,"value":1440},"Changelog entry patterns, semver rules, breaking-change checklist, CI examples",{"type":43,"tag":394,"props":1442,"children":1443},{},[1444,1452],{"type":43,"tag":416,"props":1445,"children":1446},{},[1447],{"type":43,"tag":71,"props":1448,"children":1450},{"className":1449},[],[1451],{"type":48,"value":540},{"type":43,"tag":416,"props":1453,"children":1454},{},[1455],{"type":48,"value":1456},"Feature-to-version table sourced from elastic\u002Fpackage-spec, including recent spec additions",{"type":43,"tag":1458,"props":1459,"children":1460},"style",{},[1461],{"type":48,"value":1462},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1464,"total":1566},[1465,1484,1498,1508,1525,1538,1552],{"slug":1466,"name":1466,"fn":1467,"description":1468,"org":1469,"tags":1470,"stars":23,"repoUrl":24,"updatedAt":1483},"anonymize-logs","anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1471,1474,1477,1480],{"name":1472,"slug":1473,"type":15},"Data Cleaning","data-cleaning",{"name":1475,"slug":1476,"type":15},"Logs","logs",{"name":1478,"slug":1479,"type":15},"Privacy","privacy",{"name":1481,"slug":1482,"type":15},"Security","security","2026-07-18T05:13:04.420121",{"slug":243,"name":243,"fn":1485,"description":1486,"org":1487,"tags":1488,"stars":23,"repoUrl":24,"updatedAt":1497},"write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1489,1492,1495,1496],{"name":1490,"slug":1491,"type":15},"API Development","api-development",{"name":1493,"slug":1494,"type":15},"Data Engineering","data-engineering",{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T07:47:10.207064",{"slug":206,"name":206,"fn":1499,"description":1500,"org":1501,"tags":1502,"stars":23,"repoUrl":24,"updatedAt":1507},"create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1503,1506],{"name":1504,"slug":1505,"type":15},"Elasticsearch","elasticsearch",{"name":20,"slug":21,"type":15},"2026-07-12T07:46:56.318866",{"slug":1509,"name":1509,"fn":1510,"description":1511,"org":1512,"tags":1513,"stars":23,"repoUrl":24,"updatedAt":1524},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1514,1517,1518,1521],{"name":1515,"slug":1516,"type":15},"Dashboards","dashboards",{"name":1504,"slug":1505,"type":15},{"name":1519,"slug":1520,"type":15},"Kibana","kibana",{"name":1522,"slug":1523,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":1526,"name":1526,"fn":1527,"description":1528,"org":1529,"tags":1530,"stars":23,"repoUrl":24,"updatedAt":1537},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1531,1534,1535,1536],{"name":1532,"slug":1533,"type":15},"Code Review","code-review",{"name":1515,"slug":1516,"type":15},{"name":9,"slug":8,"type":15},{"name":1519,"slug":1520,"type":15},"2026-07-12T07:47:06.493988",{"slug":231,"name":231,"fn":1539,"description":1540,"org":1541,"tags":1542,"stars":23,"repoUrl":24,"updatedAt":1551},"define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1543,1546,1549,1550],{"name":1544,"slug":1545,"type":15},"Data Modeling","data-modeling",{"name":1547,"slug":1548,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T07:47:13.472534",{"slug":304,"name":304,"fn":1553,"description":1554,"org":1555,"tags":1556,"stars":23,"repoUrl":24,"updatedAt":1565},"develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1557,1560,1561,1562],{"name":1558,"slug":1559,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":1563,"slug":1564,"type":15},"Testing","testing","2026-07-12T07:46:57.647395",14,{"items":1568,"total":1732},[1569,1588,1605,1616,1635,1647,1657,1670,1682,1695,1706,1719],{"slug":1570,"name":1570,"fn":1571,"description":1572,"org":1573,"tags":1574,"stars":1585,"repoUrl":1586,"updatedAt":1587},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1575,1578,1581,1582],{"name":1576,"slug":1577,"type":15},"Analytics","analytics",{"name":1579,"slug":1580,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":1583,"slug":1584,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":1589,"name":1589,"fn":1590,"description":1591,"org":1592,"tags":1593,"stars":1585,"repoUrl":1586,"updatedAt":1604},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1594,1597,1598,1601],{"name":1595,"slug":1596,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":1599,"slug":1600,"type":15},"Engineering","engineering",{"name":1602,"slug":1603,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1606,"name":1606,"fn":1607,"description":1608,"org":1609,"tags":1610,"stars":1585,"repoUrl":1586,"updatedAt":1615},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1611,1612,1613,1614],{"name":9,"slug":8,"type":15},{"name":1504,"slug":1505,"type":15},{"name":1583,"slug":1584,"type":15},{"name":1563,"slug":1564,"type":15},"2026-07-12T07:46:37.277964",{"slug":1617,"name":1617,"fn":1618,"description":1619,"org":1620,"tags":1621,"stars":1632,"repoUrl":1633,"updatedAt":1634},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1622,1625,1626,1629],{"name":1623,"slug":1624,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":1627,"slug":1628,"type":15},"Operations","operations",{"name":1630,"slug":1631,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":1636,"name":1636,"fn":1637,"description":1638,"org":1639,"tags":1640,"stars":1632,"repoUrl":1633,"updatedAt":1646},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1641,1642,1645],{"name":1623,"slug":1624,"type":15},{"name":1643,"slug":1644,"type":15},"Deployment","deployment",{"name":1504,"slug":1505,"type":15},"2026-07-12T07:46:42.353362",{"slug":1648,"name":1648,"fn":1649,"description":1650,"org":1651,"tags":1652,"stars":1632,"repoUrl":1633,"updatedAt":1656},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1653,1654,1655],{"name":1623,"slug":1624,"type":15},{"name":1504,"slug":1505,"type":15},{"name":1627,"slug":1628,"type":15},"2026-07-12T07:46:41.097412",{"slug":1658,"name":1658,"fn":1659,"description":1660,"org":1661,"tags":1662,"stars":1632,"repoUrl":1633,"updatedAt":1669},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1663,1664,1665,1668],{"name":1623,"slug":1624,"type":15},{"name":1504,"slug":1505,"type":15},{"name":1666,"slug":1667,"type":15},"Networking","networking",{"name":1481,"slug":1482,"type":15},"2026-07-12T07:46:43.675992",{"slug":1671,"name":1671,"fn":1672,"description":1673,"org":1674,"tags":1675,"stars":1632,"repoUrl":1633,"updatedAt":1681},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1676,1679,1680],{"name":1677,"slug":1678,"type":15},"Authentication","authentication",{"name":1623,"slug":1624,"type":15},{"name":1504,"slug":1505,"type":15},"2026-07-12T07:46:39.783105",{"slug":1683,"name":1683,"fn":1684,"description":1685,"org":1686,"tags":1687,"stars":1632,"repoUrl":1633,"updatedAt":1694},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1688,1691,1692,1693],{"name":1689,"slug":1690,"type":15},"Audit","audit",{"name":1504,"slug":1505,"type":15},{"name":1475,"slug":1476,"type":15},{"name":1481,"slug":1482,"type":15},"2026-07-12T07:47:35.092599",{"slug":1696,"name":1696,"fn":1697,"description":1698,"org":1699,"tags":1700,"stars":1632,"repoUrl":1633,"updatedAt":1705},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1701,1702,1703,1704],{"name":1677,"slug":1678,"type":15},{"name":9,"slug":8,"type":15},{"name":1504,"slug":1505,"type":15},{"name":1481,"slug":1482,"type":15},"2026-07-12T07:47:41.474547",{"slug":1707,"name":1707,"fn":1708,"description":1709,"org":1710,"tags":1711,"stars":1632,"repoUrl":1633,"updatedAt":1718},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1712,1713,1714,1717],{"name":9,"slug":8,"type":15},{"name":1504,"slug":1505,"type":15},{"name":1715,"slug":1716,"type":15},"RBAC","rbac",{"name":1481,"slug":1482,"type":15},"2026-07-12T07:47:36.394177",{"slug":1720,"name":1720,"fn":1721,"description":1722,"org":1723,"tags":1724,"stars":1632,"repoUrl":1633,"updatedAt":1731},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1725,1726,1727,1728],{"name":1576,"slug":1577,"type":15},{"name":1579,"slug":1580,"type":15},{"name":1504,"slug":1505,"type":15},{"name":1729,"slug":1730,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]