القائمة
Execute searches, aggregations, and queries. Use when finding documents, running analytics, counting records, exploring data, or performing semantic search with vectors.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | searching-data |
| description | Execute searches, aggregations, and queries. Use when finding documents, running analytics, counting records, exploring data, or performing semantic search with vectors. |
-- Simple query
ESQL FROM logs-* | WHERE level = 'ERROR' | LIMIT 10;
-- Aggregations
ESQL FROM metrics-*
| STATS avg_cpu = AVG(cpu_percent), max_mem = MAX(memory_percent) BY host.name
| SORT avg_cpu DESC;
-- Time filtering
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 1 HOUR
| WHERE message LIKE '*error*'
| LIMIT 100;
| Function | Example |
|---|---|
ES_SEARCH(index, query) | ES_SEARCH('logs', {'query': {...}}) |
ES_COUNT(index, query?) | ES_COUNT('logs', {'query': {...}}) |
ES_MSEARCH(requests) | Multi-search |
ES_SCROLL(index, query, size) | Large result sets |
ES_KNN_SEARCH(index, vector, k) | Vector similarity |
| Function | Example |
|---|---|
ES_TERMS_AGG(index, field, size) | ES_TERMS_AGG('logs', 'level', 10) |
ES_STATS_AGG(index, field) | ES_STATS_AGG('metrics', 'cpu_percent') |
ES_DATE_HISTOGRAM(index, field, interval) | Time buckets |
DECLARE results DOCUMENT;
SET results = ES_SEARCH('documents', {
'query': {
'multi_match': {
'query': 'kubernetes deployment error',
'fields': ['title', 'body', 'tags']
}
}
});
SET similar = ES_KNN_SEARCH('embeddings',
INFERENCE_EMBED('embedding-model', 'query text'),
10
);
| Skill | Description |
|---|---|
RUN SKILL search_documents(index, query, size) | Paginated search |
RUN SKILL top_values(index, field, n) | Top N values |
RUN SKILL count_by_field(index, field) | Distribution |
Master index of all Moltler/elastic-script capabilities. Use first when uncertain which skill applies, when the user asks "what can you do", or to find the right skill for a task involving Elasticsearch, observability, security, ML, or integrations.
Manage Elasticsearch Streams for data routing, field extraction, and retention. Use when working with data streams, partitioning data into child streams, extracting fields from logs, configuring data lifecycle, or routing observability data.
Query metrics using PromQL syntax in ES|QL. Use when analyzing Prometheus-style metrics, calculating rates, histograms, quantiles, or when the user mentions PromQL, Prometheus, rate(), sum(), histogram_quantile(), or metric queries.
Manage alerts, notifications, SLOs, and incident response. Use when creating alert rules, viewing active alerts, sending Slack or PagerDuty notifications, managing SLOs, or automating incident response.
Analyze logs, metrics, traces, and APM data. Use when troubleshooting issues, finding errors, analyzing performance, investigating incidents, or checking error rates and latency.
Quick start guide for Elasticsearch capabilities. Use when the user is new, asks "what can you do with Elasticsearch", wants to see available functions, or needs help getting oriented with Moltler skills.