skills.rest
elastic
elasticOFFICIAL
Explore all skills by this author →
WebsiteGitHub

kibana-workflows

Author, validate, test, and run Elastic Workflow YAML definitions in Kibana.

568|48|Updated Mar 6, 2026
Search Tags:#YAML#alerting#ElasticSearch#Automation#connectors#Workflows#Kibana
One-click install
npx skills add https://github.com/elastic/agent-skills --skill kibana-workflows
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kibana-workflows
Source: https://github.com/elastic/agent-skills/tree/main/plugins/kibana/skills/kibana-workflows
Command: npx skills add https://github.com/elastic/agent-skills --skill kibana-workflows

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Writing valid Elastic Workflow YAML by hand is error-prone: step types, connector IDs, trigger schemas, and templating rules vary by Kibana version, and mistakes surface only at runtime. This Skill guides an AI agent through the full lifecycle of turning natural language into a tested, saved, and runnable Kibana workflow.

Core Features & Use Cases

  • Guided authoring paths: Probes the target Kibana for platform.workflows.* Agent Builder tools and picks the right authoring path (discovery tools, LLM generator, or raw JSON Schema fallback).
  • Safe test loop: Validates YAML, executes drafts via the workflows test API, polls executions, and inspects step logs before saving.
  • Reference library: Ships pattern catalogs, a YAML reference, generation tips, and a demo test loop for common shapes like scheduled reports, alert triage, and connector notifications.
  • Use Case: Ask for "a workflow that runs every hour, queries logs with ES|QL, and posts a summary to Slack" and get a validated workflow saved to Kibana with the correct connector ID resolved.

Quick Start

Use the kibana-workflows skill to create a manual workflow that logs a greeting, test it against my Kibana, then save and run it.

Frequently Asked Questions about kibana-workflows

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a Kibana workflow from a natural language description?▼

Describe the trigger (manual, scheduled, or alert), inputs, data sources, and actions you want. The skill probes the target Kibana for platform.workflows tools, drafts the YAML, validates it, and tests it via the workflows test API before saving.

How do I test an Elastic workflow before running it in production?▼

Call POST kbn:/api/workflows/test with the workflow YAML and inputs, which executes the graph. For workflows with side effects, test a copy where writes and notifications are replaced with console steps, then restore the real steps and save the workflow disabled.

What Kibana version is required for Elastic Workflows?▼

Workflows require Kibana 9.4 or later with matching Elasticsearch and an Enterprise license, or an Elastic Serverless project with Workflows available. The platform.workflows discovery tools are registered by default on Kibana 9.5+ and Serverless.

How do I reference step outputs and alert event data in workflow YAML?▼

Reference prior step results as steps.<name>.output and alert trigger data as event, never triggers.event or steps.<name>.with. Use {{ ... }} for text rendering and ${{ ... }} when a value must keep its native type.

Why does my workflow connector step fail before execution?▼

Connector steps require a valid connector-id field. Resolve real connector instance IDs with platform.workflows.get_connectors or GET kbn:/api/workflows/connectors instead of guessing, and confirm the exact action type from the strict workflow schema.

When should I use the schema path instead of the discovery tools path?▼

Use the schema path only when platform.workflows.* tools are not registered, typically Kibana 9.4 or deployments without Agent Builder. It is significantly slower and costlier because the roughly 2 MB strict JSON Schema must be queried directly.

Related Skills

Explore More Software Engineering Skills→
elasticelastic
546

cloud-manage-project

Manage Elastic Cloud Serverless projects via the Elastic Cloud API.

Official
Advanced
hmzainjamilhmzainjamil
1

Security Monitoring

Automate security monitoring, threat detection, and incident response from enterprise logs.

Community
Advanced
elasticelastic
546

security-alert-triage

Automate triage of Elastic Security alerts with ES|QL queries and case management.

Official
Advanced
elasticelastic
546

kibana-agent-builder

Manages Kibana Agent Builder agents and custom tools via command-line interface.

Official
Advanced