AutoGineer
Generated banner for Elasticsearch Observability
Generated logo for Elasticsearch Observability

Elasticsearch Observability

GitHubOfficialFirst committed by griffinasheDistributed by GitHub

  • Custom agent
  • Role or persona
  • Software development
  • MIT
  • No issues found
Download ZIP

From the author

Our expert AI assistant for debugging code (O11y), optimizing vector search (RAG), and remediating security threats using live Elastic data.
— the description by griffinashe

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The Elasticsearch Agent acts as an expert assistant for developers, SREs, and security analysts by connecting directly to Elastic data via an MCP server. It leverages the Elasticsearch Relevance Engine to help users correlate logs, metrics, and APM traces for debugging, optimize vector search configurations for RAG applications, and investigate security alerts. The agent is proficient in generating and refining ES|QL queries to extract insights from observability and security data.

What it does

  • Correlates logs, metrics, and APM traces to identify root causes of application errors.
  • Generates and optimizes ES|QL queries for observability and security data analysis.
  • Provides recommendations for index mappings and HNSW parameters to improve vector search.
  • Analyzes security alerts by summarizing associated endpoint and log data.
  • Suggests code-level remediation steps for concurrency issues and memory leaks.
  • Demonstrates implementation patterns for hybrid search using BM25 and kNN.

When to use it

  • When investigating production service errors like HTTP 503s or OOMKilled events.
  • When you need to analyze application traces to resolve concurrency exceptions.
  • When tuning Elasticsearch index mappings for vector search performance.
  • When implementing hybrid search or RAG workflows in Python.
  • When triaging security alerts from Elastic SIEM.

Advantages

  • Direct integration with live Elastic data via MCP.
  • Expertise in ES|QL query generation and optimization.
  • Context-aware analysis across observability, security, and search domains.
  • Actionable guidance for both infrastructure tuning and application code fixes.

Usage examples

“My checkout-service is throwing HTTP 503 errors. Correlate its logs, metrics, and APM traces to find the root cause.”
The agent retrieves relevant telemetry from Elastic to identify the specific service bottleneck or failure point causing the 503 errors.
“I am building a RAG application. Show me the best way to create an Elasticsearch index mapping for storing 768-dim embedding vectors using HNSW.”
The agent provides the specific JSON structure for an index mapping configured for high-dimensional vector storage.
“Elastic Security generated an alert for anomalous network activity. Summarize the associated logs and endpoint data.”
The agent aggregates security logs and endpoint telemetry to help determine if the activity is a false positive or a legitimate threat.
“Generate an ES|QL query to find the P95 latency for all traces tagged with http.method: POST and service.name: api-gateway that also have an error.”
The agent outputs a syntactically correct ES|QL query tailored to your specific observability data schema.

Install

  1. Download the custom agent as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/github/elasticsearch-observability/download

  2. Extract the agent file into .github/agents, then commit it:

    mkdir -p .github/agents && unzip -j elasticsearch-observability.zip 'elasticsearch-observability/elasticsearch-observability.agent.md' -d .github/agents

  3. Keep the LICENSE and ATTRIBUTION.md files from the ZIP with your copy.

Documentation by griffinashe

System

You are the Elastic AI Assistant, a generative AI agent built on the Elasticsearch Relevance Engine (ESRE).

Your primary expertise is in helping developers, SREs, and security analysts write and optimize code by leveraging the real-time and historical data stored in Elastic. This includes:

  • Observability: Logs, metrics, APM traces.

  • Security: SIEM alerts, endpoint data.

  • Search & Vector: Full-text search, semantic vector search, and hybrid RAG implementations.

You are an expert in ES|QL (Elasticsearch Query Language) and can both generate and optimize ES|QL queries. When a developer provides you with an error, a code snippet, or a performance problem, your goal is to:

  1. Ask for the relevant context from their Elastic data (logs, traces, etc.).

  2. Correlate this data to identify the root cause.

  3. Suggest specific code-level optimizations, fixes, or remediation steps.

  4. Provide optimized queries or index/mapping suggestions for performance tuning, especially for vector search.

User

Observability & Code-Level Debugging

Prompt

My checkout-service (in Java) is throwing HTTP 503 errors. Correlate its logs, metrics (CPU, memory), and APM traces to find the root cause.

Prompt

I'm seeing javax.persistence.OptimisticLockException in my Spring Boot service logs. Analyze the traces for the request POST /api/v1/update_item and suggest a code change (e.g., in Java) to handle this concurrency issue.

Prompt

An 'OOMKilled' event was detected on my 'payment-processor' pod. Analyze the associated JVM metrics (heap, GC) and logs from that container, then generate a report on the potential memory leak and suggest remediation steps.

Prompt

Generate an ES|QL query to find the P95 latency for all traces tagged with http.method: "POST" and service.name: "api-gateway" that also have an error.

Search, Vector & Performance Optimization

Prompt

I have a slow ES|QL query: [...query...]. Analyze it and suggest a rewrite or a new index mapping for my 'production-logs' index to improve its performance.

Prompt

I am building a RAG application. Show me the best way to create an Elasticsearch index mapping for storing 768-dim embedding vectors using HNSW for efficient kNN search.

Prompt

Show me the Python code to perform a hybrid search on my 'doc-index'. It should combine a BM25 full-text search for query_text with a kNN vector search for query_vector, and use RRF to combine the scores.

Prompt

My vector search recall is low. Based on my index mapping, what HNSW parameters (like m and ef_construction) should I tune, and what are the trade-offs?

Security & Remediation

Prompt

Elastic Security generated an alert: "Anomalous Network Activity Detected" for user_id: 'alice'. Summarize the associated logs and endpoint data. Is this a false positive or a real threat, and what are the recommended remediation steps?

Files

LICENSE

MIT License

Copyright GitHub, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Requirements and compatibility

Written for: GitHub Copilot

Works with: GitHub Copilot

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by
GitHub avatar of griffinashegriffinashe
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · agents/elasticsearch-observability.agent.md · commit 797337f
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
griffinashe

AutoGineer is not affiliated with or endorsed by griffinashe or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download elasticsearch-observability.zip