elasticsearch

Query Elasticsearch logs, APM traces, and errors via REST API.

6|2|Updated Jul 8, 2012
One-click install
npx skills add https://github.com/athal7/dotfiles --skill elasticsearch-athal7
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: elasticsearch
Source: https://github.com/athal7/dotfiles/tree/main/skills/elasticsearch
Command: npx skills add https://github.com/athal7/dotfiles --skill elasticsearch-athal7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Query and correlate logs, APM traces, and errors stored in Elasticsearch using REST APIs, with guidance on index patterns, fields, and time-range syntax.

Core Features & Use Cases

  • Log searches: scan logs-* with time-bounded queries to surface relevant events.
  • APM trace exploration: locate slow transactions in traces-apm* and inspect metadata.
  • Error analysis: identify error groups in logs-apm.error-* and extract useful fields for debugging.
  • Use Case: When investigating a production incident, quickly search for recent errors, see related traces, and surface performance hotspots.

Quick Start

Run a basic search against logs-*/_search to retrieve recent events and inspect fields like @timestamp, log.level, service.name, and message.

Frequently Asked Questions about elasticsearch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Elasticsearch logs to investigate a production incident?

Query Elasticsearch logs by running time-bounded searches against the logs-*/_search REST API endpoint to surface recent events using fields like @timestamp, log.level, service.name, and message for incident investigation.

How can I find slow transactions in Elasticsearch APM traces?

Locate slow transactions in Elasticsearch APM traces by querying the traces-apm* indices through the REST API to inspect transaction metadata and identify performance hotspots during performance analysis.

What's the best way to analyze error groups stored in Elasticsearch?

Analyze Elasticsearch error groups by querying the logs-apm.error-* indices through the REST API to identify error patterns and extract useful fields like service.name and log.level for debugging.

What time-range syntax does Elasticsearch need for querying recent observability data?

Elasticsearch observability queries require time-range syntax such as now-1h to construct effective time-bounded searches across logs-* and traces-apm* indices using the @timestamp field.

What index patterns and fields are required to search Elasticsearch logs and traces?

Searching Elasticsearch logs and traces requires index patterns like logs-*, traces-apm*, and logs-apm.error-*, along with field names including @timestamp, log.level, service.name, and message to construct effective queries.

Do I need specific index patterns to use Elasticsearch for observability and error analysis?

Yes, Elasticsearch observability queries require specific index patterns like logs-*, traces-apm*, and logs-apm.error-* to surface relevant events, correlate logs with APM traces, and identify error groups for incident investigation.