Menu
Teach ES|QL query writing and when to use it
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.
| name | esql-guide |
| description | Teach ES|QL query writing and when to use it |
Use when the user wants to write or understand ES|QL (Elasticsearch Query Language) queries.
get_mappings or list_indices so the user knows index and field names.FROM index | WHERE ... | STATS ... | SORT ... | LIMIT n.esql_query to run the query.When writing ES|QL for Kibana dashboard panels, the column alias IS the display label:
STATS `Tank Level (%)` = AVG(field) not STATS avg_val = AVG(field). The alias appears as the metric subtitle, axis label, and table header.STATS `pH` = ROUND(AVG(field), 2) avoids showing 7.003575848691441 in KPIs.BY `Site` = \`attributes.site.name\` for clean breakdown legends instead of raw dotted field paths.BUCKET(@timestamp, 30 seconds). If data spans hours, use 5 minute. Too-large buckets collapse everything into one flat point.WHERE field IS NOT NULL prevents empty data points in time-series panels.time_series_metric: "counter" (e.g. metrics.sanitation.cycle_count) reject AVG/SUM/MAX. Cast first: EVAL c = TO_DOUBLE(counter_field) | STATS AVG(c).esql_query and show tabular output.