elasticsearch

Query Elasticsearch logs, APM traces, and errors via REST API.

6|2|Updated Jul 8, 2012

Search Tags:#logs #search #observability #elasticsearch #traces #rest-api #apm

Ready to run

npx skills add https://github.com/athal7/dotfiles --skill elasticsearch-athal7

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: elasticsearch
Source: https://github.com/athal7/dotfiles/tree/main/skills/elasticsearch
Command: npx skills add https://github.com/athal7/dotfiles --skill elasticsearch-athal7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Query and correlate logs, APM traces, and errors stored in Elasticsearch using REST APIs, with guidance on index patterns, fields, and time-range syntax.

Core Features & Use Cases

Log searches: scan logs-* with time-bounded queries to surface relevant events.
APM trace exploration: locate slow transactions in traces-apm* and inspect metadata.
Error analysis: identify error groups in logs-apm.error-* and extract useful fields for debugging.
Use Case: When investigating a production incident, quickly search for recent errors, see related traces, and surface performance hotspots.

Quick Start

Run a basic search against logs-*/_search to retrieve recent events and inspect fields like @timestamp, log.level, service.name, and message.

Frequently Asked Questions about elasticsearch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I query Elasticsearch logs to investigate a production incident?▼

Query Elasticsearch logs by running time-bounded searches against the logs-*/_search REST API endpoint to surface recent events using fields like @timestamp, log.level, service.name, and message for incident investigation.

How can I find slow transactions in Elasticsearch APM traces?▼

Locate slow transactions in Elasticsearch APM traces by querying the traces-apm* indices through the REST API to inspect transaction metadata and identify performance hotspots during performance analysis.

What's the best way to analyze error groups stored in Elasticsearch?▼

Analyze Elasticsearch error groups by querying the logs-apm.error-* indices through the REST API to identify error patterns and extract useful fields like service.name and log.level for debugging.

What time-range syntax does Elasticsearch need for querying recent observability data?▼

Elasticsearch observability queries require time-range syntax such as now-1h to construct effective time-bounded searches across logs-* and traces-apm* indices using the @timestamp field.

What index patterns and fields are required to search Elasticsearch logs and traces?▼

Searching Elasticsearch logs and traces requires index patterns like logs-*, traces-apm*, and logs-apm.error-*, along with field names including @timestamp, log.level, service.name, and message to construct effective queries.

Do I need specific index patterns to use Elasticsearch for observability and error analysis?▼

Yes, Elasticsearch observability queries require specific index patterns like logs-*, traces-apm*, and logs-apm.error-* to surface relevant events, correlate logs with APM traces, and identify error groups for incident investigation.