skills.rest
elastic
elasticOFFICIAL
Explore all skills by this author →
WebsiteGitHub

kibana-anomaly-detection

Investigate, explain, troubleshoot, and manage Elastic ML anomaly detection jobs via Kibana Agent Builder MCP tools.

568|48|Updated Mar 6, 2026
Search Tags:#anomaly detection#ElasticSearch#Root Cause Analysis#esql#Kibana#Machine learning#datafeed
One-click install
npx skills add https://github.com/elastic/agent-skills --skill kibana-anomaly-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kibana-anomaly-detection
Source: https://github.com/elastic/agent-skills/tree/main/plugins/kibana/skills/kibana-anomaly-detection
Command: npx skills add https://github.com/elastic/agent-skills --skill kibana-anomaly-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Elastic ML anomaly detection jobs are hard to operate: scores change unexpectedly, datafeeds stop, memory limits corrupt model state, and root-cause analysis across jobs requires deep knowledge of .ml-anomalies-* indices and dozens of APIs. This Skill gives an AI agent the exact tool chains, ES|QL templates, and operational protocols to answer "what broke?", "why is the score high/low?", and "how do I fix or create this job?" correctly.

Core Features & Use Cases

  • Investigate (RCA): Cross-job entity correlation, blast radius analysis, influencer ranking, and source-evidence confirmation using ad_rca_* tools against .ml-anomalies-*.
  • Explain: Diagnose score behavior including renormalization drift, anomaly_score_explanation components, model bounds, and forecasts.
  • Troubleshoot: Fix missing documents (query_delay), memory soft_limit/hard_limit, stopped datafeeds, and CCS issues with guided workflow tools.
  • Manage: Create and validate anomaly detection jobs and datafeeds with correct detector functions (rare, high_mean, high_sum, etc.), then open and start them.
  • Use Case: After a 2pm error-rate spike, ask the agent "what broke?" — it runs the 14-step investigation protocol, identifies the multi-job root-cause entity, reconstructs the cascade timeline, and confirms with raw source documents.

Quick Start

Ask the agent to investigate what caused the anomaly spike in your Elastic ML jobs this afternoon and produce a root-cause report.

Frequently Asked Questions about kibana-anomaly-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the root cause of an anomaly across multiple Elastic ML jobs?▼

Use the Investigate mode: run ad_rca_multi_job_entities with min_job_count=2 to find entities anomalous in multiple jobs, then ad_rca_correlation for temporal ordering and ad_rca_source_evidence to confirm with raw source documents. Multi-job entities are the prime suspects.

Why did my Elastic ML anomaly score drop overnight?▼

Score drops are usually caused by renormalization: when the model sees worse anomalies later, earlier scores are renormalized downward. Compare initial_record_score against record_score using ad_rca_score_reassessment — the gap is the renormalization drift, not a config problem.

How do I fix missing documents in an anomaly detection datafeed?▼

Check delayed data with ad_ts_delayed_data_annotations and ad_ts_bucket_event_gaps, estimate ingest latency with ad_ts_ingest_latency_estimate, then set query_delay to P95 ingest latency plus buffer. Fix memory hard_limit issues first, since they cause false missing-doc alarms.

Which detector function should I use for an Elastic ML anomaly detection job?▼

Match the function to intent: high_mean or high_sum for unusually large values, rare for infrequent values, high_count for volume spikes, and non_zero_count for sparse data. One-sided high_/low_ variants reduce noise when only one direction matters.

What Kibana and Elasticsearch versions does this anomaly detection skill support?▼

The skill targets Kibana 8.x-9.x with Agent Builder and Workflows, and Elasticsearch 8.x-9.x with machine learning enabled. The registration scripts are written for Kibana 9.4+ and fall back to DELETE plus POST on stacks without tool PUT support.

Why do anomaly detection tools return empty results in Kibana Agent Builder?▼

Empty results are most often caused by missing privileges, not missing data. Run ad_validate_ml_tool_permissions first; the MCP API key needs read and view_index_metadata on .ml-anomalies-*, .ml-annotations-*, .ml-notifications-*, and .ml-config indices.

Related Skills

Explore More Software Engineering Skills→
athal7athal7
6

elasticsearch

Query Elasticsearch logs, APM traces, and errors via REST API.

Community
Advanced
patrykkopycinskipatrykkopycinski
6

kibana-alerting

Configure Kibana alerting rules and connectors for threshold, anomaly, and ML conditions.

Community
Intermediate
elasticelastic
546

observability-service-health

Assess APM service health by querying Observability APIs and Elasticsearch.

Official
Advanced
elasticelastic
546

kibana-vega

Create and manage Vega and Vega-Lite visualizations in Kibana using ES|QL.

Official
Advanced