Elastic Agent Skills plugin
Official Elastic skills for Elasticsearch, Kibana, Observability, Security and Elastic Cloud: ES|QL, indices, dashboards, alert triage
- 602 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Skills run queries and changes on clusters and Elastic Cloud with API keys
- Security skills process alert data that may contain attacker-controlled content
Install
- Works in
Manual install
claude plugin marketplace add https://github.com/elastic/agent-skills
claude plugin install elastic-elasticsearch@elastic-agent-skillsOther plugins: elastic-kibana, elastic-observability, elastic-security, elastic-cloud.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Skills run queries and changes on clusters and Elastic Cloud with API keys
- Security skills process alert data that may contain attacker-controlled content
This is third-party code. Review the repository files before installing.
What it does
Skills from the Elastic team teach the agent to work with the platform correctly rather than from outdated examples. The Elasticsearch set covers ES|QL queries, mapping design, CSV and JSON ingest via the bulk API, reindexing, cluster health diagnosis, slow query optimization, relevance tuning and anomaly detection jobs. Kibana skills build dashboards, alerting rules, workflows and Agent Builder agents. Observability skills help investigate Kubernetes incidents, service reliability and LLM observability, and Security skills triage alerts and manage cases and detection rules. Cloud skills set up access and create Serverless projects.
Who it is for. For engineers, SREs and security analysts working with the Elastic Stack or Elastic Cloud.
Good fit when
- You need an ES|QL query or a faster slow search
- You need to find out why a cluster is yellow or red
- You need to triage a queue of security alerts in Kibana
Not a fit when
- You use OpenSearch: the APIs differ
- You are not ready to give the agent access to production security data
Example request
The cluster is red; find unassigned shards and explain the most likely cause without changing the clusterLimitations
The skills are a technical preview and will change. They need access to a cluster or Elastic Cloud and API keys, and some require the elastic CLI. The authors advise installing only what you need, starting in a test environment with minimal privileges, since alert data can carry prompt injection.
How to disable. Remove the plugins via /plugins in Claude Code or copilot plugin in GitHub Copilot CLI, or delete the skill folders from the agent directory.
FAQ
Where do I start?
The authors suggest installing the cloud and elasticsearch skills first, since others depend on them, then adding more as needed.
Plugins did not show up after install. What now?
This is a known Claude Code issue: restart the session.
Discussion
No questions or reviews yet.
Related
PluginsDatabricks Field Engineering's agent kit: an installer for Databricks skills, an MCP server and a visual Builder App
A data visualization skill for agents: turns data into polished interactive HTML charts and full reports with one visual language
Official ClickHouse skills: schema and query rules, architecture decisions, chDB for Python and ClickHouse Cloud workflows
A community collection of Apify skills: ready routes to Actors for leads, jobs, prices, ads, Reddit and Yandex search
Microsoft plugin for Fabric: warehouses and Lakehouse, Spark, Power BI, Eventhouse, event streams and migrations for Copilot CLI and Claude Code
Official Apify skills for agents: web scraping via ready-made Actors, plus building, actorizing and integrating Actors
README in short
The README flags the technical preview status and lists skills by group with versions. A large section covers security: threat modeling, data in model context, attacks via alert content, least privilege and test environments. Installation is described via Claude Code plugins, GitHub Copilot CLI plugins, npx skills and cloning with an install script. Apache 2.0 licensed.