elasticsearch-skill_skill

Overview

This skill lets you interact with Elasticsearch and Kibana directly via the REST API using curl. It provides ready-to-use patterns for searching (Query DSL and ES|QL), indexing, mappings, aggregations, cluster health, ILM, ingest pipelines, and Kibana saved objects. Requires the cluster URL and a Base64 API key exported as ES_URL and ES_API_KEY.

How this skill works

Commands are plain curl requests against the Elasticsearch or Kibana HTTP endpoints with Authorization: ApiKey headers. The skill shows how to set ES_URL/ES_API_KEY, avoid common pitfalls (trailing slash and variable expansion), and use jq for readable output. It covers search queries, CRUD, bulk, reindexing, index templates, ILM, data streams, ingest pipeline simulation, and Kibana API calls.

When to use it

• Query logs, metrics, or documents with Query DSL or ES|QL
• Index documents, update mappings, create templates, or run bulk imports
• Build aggregations and date histograms for analytics and dashboards
• Manage indices, aliases, rollovers, ILM policies, and reindex operations
• Troubleshoot cluster health, shard allocation, pending tasks, or node performance
• Deploy or export Kibana dashboards, data views, and saved objects

Best practices

• Always export ES_URL and ES_API_KEY and use ${ES_URL%/} to strip trailing slashes
• Use $(printenv ES_API_KEY) in curl headers to avoid empty Authorization values
• Pipe responses to jq for readable JSON and use ?size=0 for aggregation-only queries
• Use index templates and aliases for predictable time-series rollover patterns
• Avoid from/size for large exports; use PIT + search_after or scroll for bulk exports
• Check mappings before queries: keyword for aggregations, text for full-text search

Example use cases

• Run a bool query to find error logs in the last hour and exclude debug level entries
• Create an index with explicit mappings and index a document with a specific ID
• Run a terms aggregation to list top service names and a date_histogram to monitor trends
• Create an ingest pipeline with grok + date processors and simulate with _simulate
• Define an ILM policy for rollover, shrink, and delete phases and check _ilm/explain
• Export or import Kibana dashboards and data views via the Kibana saved_objects API