elastic-cursor-plugin

Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.

Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.

Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.

Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.

Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.

Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.

Interactive workflow for investigating and triaging security alerts — from alert review through enrichment, investigation, and resolution.

Guide for creating and managing security investigation cases — from case creation through alert attachment, investigation tracking, and resolution.

Guide for authoring custom detection rules — from threat hypothesis through rule creation, testing, and tuning with KQL, EQL, ES|QL, and threshold rules.

Interactive threat hunting workflow using ES|QL and Elasticsearch queries — from hypothesis formulation through data exploration, IOC search, and finding documentation.

Guide for building, testing, and deploying custom Agent Builder skills — from tool creation through agent configuration and MCP handoff.

Set up APM instrumentation and log shipping — framework-specific agents, Filebeat, Elastic Agent, and correlation.

Interactive guide for complete Observability setup — discovers data, presents summary, creates dashboards and SLOs based on user approval.

Audit and improve the Elastic Cursor Plugin itself — analyze coverage gaps, identify missing tools/skills/rules, assess quality, and implement improvements. Use when asked to improve, extend, audit, or enhance the plugin.

Interactive guide for complete Elastic Security setup — discovers data sources, assesses detection coverage, configures rules, and creates security dashboards.

Security monitoring and SIEM setup with Elastic Security

APM setup for Node.js applications (Express, Fastify, Koa, NestJS)

Teach ES|QL query writing and when to use it

Create Kibana dashboards from descriptions

Create and edit visualizations with Kibana Lens

Complete onboarding from no infrastructure to a working Elasticsearch-backed app

Use Elastic Agent Builder and Agent Builder MCP from the IDE (define tools, test, connect Cursor/Claude)

APM setup for Java/Spring Boot applications

APM setup for Python applications (Django, Flask, FastAPI)

Configure Elastic Agent for log and metric collection

Build automation and workflows with alerting, ingest pipelines, security, and Agent Builder

Guide optimal index mapping and design for Elasticsearch

Configure Kibana alerting and rules (stack rules, connector types)

Create pixel-perfect reports and dashboards with Kibana Canvas

Create and manage Kibana data views (index patterns)

Use Kibana Dev Tools (Console) for Elasticsearch API calls

Use Kibana Discover for ad-hoc search and exploration

Create and use Kibana Maps for geospatial data

Migration workflow from Algolia to Elasticsearch

APM and observability migration from Datadog to Elastic

Migration workflow from Pinecone to Elasticsearch

RAG setup with Elasticsearch as the retrieval backend

Build an Elastic search application from scratch

Complete flow from index creation to working vector search with Elasticsearch