Query Elasticsearch with ES|QL: Agent Skill Spotlight

Where this fits

You are debugging a production latency spike. Logs live in Elasticsearch, but you do not want to leave your terminal to piece together a query. With the elasticsearch-esql skill, an agent can inspect the available data, choose the right ES|QL features, run a query, and refine it based on actual results. It turns a vague request like "find the error pattern" into a complete investigation loop.

Why agents benefit

• Discovers the schema first: the agent lists fields before writing queries, so it does not guess at indices or property names.
• Uses version-gated knowledge: ES|QL features vary by Elasticsearch version; the skill references version history and avoids invalid syntax.
• Executes queries and reads results: this enables iterative correction instead of one-shot code generation.
• Handles credentials through the official elastic CLI: no environment guessing or raw HTTP workarounds.
• Produces chart-ready aggregations: results can feed directly into dashboard and visualization workflows.

Practical scenarios

Debugging a log spike

The agent searches recent logs, aggregates error counts by service, examines stack traces, and points the developer to the most plausible root cause.

Building an ops dashboard from a sentence

The user asks for "CPU by host for the last hour." The agent discovers the schema, builds an ES|QL query with aggregations and date histograms, and returns chart configuration based on the results.

Investigating failed auth events

The analyst wants to know where failed logins are coming from. The agent filters authentication events, groups by source IP, and highlights brute-force candidates.

Add it to your agent workflow

Install the skill with:

npx skills add elastic/agent-skills --skill elasticsearch-esql

Then a developer can say: "Query the last 30 minutes of payment-service logs and group failures by message." The agent will check the index schema, choose the right ES|QL functions, run the query, and summarize the findings. The skill is listed in OpenAgentSkill as a research-category skill, which makes sense: it is an exploration tool first, not a generic Elasticsearch client.

Requires Elasticsearch 8.14 or later and the elastic CLI >= 0.2 with stack es support.

Compare before adopting

Before adopting, compare:

• Quality signals: official Elastic repository, 568 stars, clear versioning.
• Maintenance freshness: v0.7.0 and an active repo; check the latest release before committing.
• Alternatives: Kibana Lens, SQL connectors, or generic HTTP wrapper skills may fit smaller use cases.
• Workflow fit: if your agent already uses the elastic CLI, this skill is seamless; otherwise, factor in setup cost.

Why it is worth tracking

This skill is worth tracking because ES|QL is now GA and becoming the standard way to explore Elasticsearch. An agent skill that respects version gates and official CLI conventions is practical for log, metric, and security investigations. As the Elastic repo evolves, it may broaden into more stack operations. If your agents work with observability or security data, evaluate this skill now. The full profile is available at https://www.openagentskill.com/skills/elastic-elasticsearch-esql.