Menu
Set up APM instrumentation and log shipping โ framework-specific agents, Filebeat, Elastic Agent, and correlation.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Debug and analyze LLM eval runs โ view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing โ attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster โ Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard โ discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data โ identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices โ mappings, settings, templates, data streams, and lifecycle policies.
| name | apm-log-shipping-setup |
| description | Set up APM instrumentation and log shipping โ framework-specific agents, Filebeat, Elastic Agent, and correlation. |
Help users instrument applications with APM agents and configure log shipping for centralized observability.
Use when the user asks to:
Also activates on keywords: "APM agent", "Filebeat", "log shipping", "Elastic Agent", "instrumentation", "tracing", "OpenTelemetry"
Do NOT use when:
o11y-service-dashboard)o11y-slo-setup)o11y-full-setup, which orchestrates this skill)get_cluster_context โ Cluster orientation and versionsetup_apm โ Generate framework-specific APM instrumentation codesetup_log_shipping โ Generate Filebeat/Elastic Agent configurationdiscover_o11y_data โ Verify data is arriving after setupelasticsearch_api โ Check indices, verify dataesql_query โ Query APM and log dataCall get_cluster_context for cluster URL, version, and auth method.
Ask about:
Call setup_apm with the user's framework to generate:
ELASTIC_APM_SERVER_URL, ELASTIC_APM_SECRET_TOKEN, ELASTIC_APM_SERVICE_NAME)Key guidance:
service.name, service.version, and deployment.environmentCall setup_log_shipping with the user's log source to generate:
Key guidance:
message, log.level, service.name, trace.idtrace.id to log output for APM โ log correlationdecode_json_fields processorcontainer input with autodiscoverkubernetes providerConfigure correlation between APM traces and logs:
trace.id and span.id into application log contextMDCUtils.addTraceId())elasticapm structlog/logging processordiscover_o11y_data to check for new APM services and log sourcesesql_query to verify:
FROM traces-apm* | STATS count = COUNT(*) BY service.name | LIMIT 10FROM logs-* | WHERE service.name == "<name>" | SORT @timestamp DESC | LIMIT 5FROM logs-* | WHERE trace.id IS NOT NULL | LIMIT 5Suggest:
o11y-service-dashboard)o11y-slo-setup)ES_URL and ES_API_KEY configuredo11y-full-setup โ Umbrella skill that orchestrates APM + logs + dashboards + SLOso11y-service-dashboard โ Create dashboards after data is flowingo11y-slo-setup โ Set up SLOs for the instrumented service