stack-sinceMaintain codegen/functional/stack-since.json, the per-API "introduced in" versions that gate ES and Kibana functional tests by STACK_VERSION. Use when adding a stack version to the Buildkite matrix, bumping @elastic/schemas, or when a functional test fails on…build-failureDiagnose Elastic CLI CI and local build failures.buildInstall, compile, and verify a clean Elastic CLI checkout.testWrite and run Elastic CLI unit and functional tests.code-reviewGuidelines to apply when doing a code review on a pull request
リポジトリエクスプローラー
elastic · リポジトリと代表的な skills - 2ページ
38 件の GitHub リポジトリにある 283 件の収集済み skills をリポジトリ単位で表示します。
esdiagCollect, share, process, or analyze Elasticsearch, Kibana, and Logstash diagnostics with `esdiag`. Setup or install esdiag tools; Ask Kibana Agent Builder diagnostic questions.esdiagCollect, share, process, or analyze Elasticsearch, Kibana, and Logstash diagnostics with `esdiag`. Setup or install esdiag tools; Ask Kibana Agent Builder diagnostic questions.esdiag-releasePrepare and verify ESDiag numbered releases, with explicit human approval for publication. Use when cutting a maintenance branch, setting a stable version, drafting notes, publishing containers or crates.io crates, creating a numeric tag, attaching native…changelogMaintain `CHANGELOG.md` entries using Keep a Changelog 1.1.0 conventions. Use when adding or reviewing changelog entries, preparing unreleased notes for a PR, or checking whether changelog bullets are correctly scoped and referenced during PR review workflows.agentic-diagnostic-assistantAnalyze Elasticsearch diagnostic bundles and ESDiag diagnostic dashboards for cluster health, ingest/search performance, shard sizing and allocation, ILM/lifecycle behavior, node/host capacity, hotspots, thread pool pressure, and storage efficiency. Use when…
alert-triageTriage Elastic Security alerts — fetch, investigate, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, investigating detections, reviewing security incidents, or when the user mentions ransomware, malware,…attack-discovery-triageTriage Elastic Security Attack Discovery findings — fetch correlated attack narratives, assess confidence with entity risk and rule frequency signals, and present an interactive triage dashboard for approval, case creation, and acknowledgment. Use when…case-managementCreate, search, update, and manage SOC cases for Elastic Security. ALWAYS use this skill when the user mentions cases, incidents, investigations, or asks to see, show, list, open, create, update, or search cases. Trigger for: "show me my cases", "open cases",…detection-rule-managementCreate, tune, and manage Elastic Security detection rules. Use for false positive tuning, adding exceptions, creating new detection coverage, finding noisy rules, enabling/disabling rules, or any detection engineering task. Also trigger for "detection rules",…generate-sample-dataGenerate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, setting up a POC, or when the user asks for test data, demo data, or sample alerts.
ref-resolutionUse any time a branch, tag, or version in the user's question is ambiguous or unspecified - whether at the start of a question or mid-conversation (e.g. when comparing behavior across versions).subagent-orchestrationUse when a request decomposes into multiple independent subtasks that can be worked on separately and combined afterward.code-searchUse when you need to find where something is defined, understand how a feature is implemented, or explore an unfamiliar repo. Guides which tools to use and in what order.repo-discoveryUse at the start of most questions to identify which repos are indexed before querying content. Also use mid-conversation when an answer may require expanding into a related or upstream repo (e.g. tracing from an application repo into a lower-level…code-citationsUse whenever an answer names a code symbol, class, function, config key, endpoint, file, directory, or file extension - or makes any checkable claim about repository behavior (a default value, a version, a recall/latency figure, a behavioral guarantee). This…
elastic-agent-diagnosticsAnalyze an elastic-agent diagnostics bundle (the .zip produced by `elastic-agent diagnostics`). Use when the user provides a bundle path or asks to triage agent state, parse logs, inspect configs/components, or analyze pprof profiles from a bundle.elastic-agent-it-failure-rcaRoot-cause an elastic-agent integration test failure from CI. Use when the user provides a flaky-test issue from elastic/elastic-agent (e.g. "look atintegration-test-reviewReview elastic-agent integration test changes (testing/integration/**) for flakiness risks before merge. Use when reviewing a PR, diff, or commit that adds or modifies integration tests, or when asked whether an integration test will be stable in CI.docs-authoringWrite or edit user-facing documentation. Use when a change adds or edits a published doc page, a snippet, navigation, or the source that generates a page. Decides whether a change needs docs, where the content goes, what must be verified against the product,…
elastic-cli-usageGuides execution of elasticsearch CLI commands via elastic_cli, resolves serverless-specific errors, and routes tasks between CLI and MCP/Kibana API tools. Use when running es or kb commands, debugging elastic CLI argument syntax, hitting 410 serverless…elasticsearch-esqlUse this skill when writing or debugging ES|QL queries for Elasticsearch. Activate when the user asks to query logs, metrics, traces, or any Elasticsearch data using ES|QL syntax.observability-rcaUse this skill when performing root cause analysis on incidents detected by Elastic Observability. Activate when the user reports a production issue, outage, degraded performance, or asks to investigate alerts.slo-managementUse this skill when working with Elastic SLOs (Service Level Objectives). Activate when the user asks about SLO status, burn rates, error budgets, or needs to create and manage SLO definitions.
developing-rallyWork on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.accessing-benchmark-resultsRetrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g.…running-benchmarksRun Rally benchmarks (races) against Elasticsearch — an existing/external cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting…
package-spec-releasePrepares a package-spec release branch from elastic/main, finalizes spec/changelog.yml, updates compliance CI matrix, reviews Go toolchain (prompts whether to adopt a newer Go minor when stable releases are ahead, otherwise patch-only .go-version), updates…review-prReview a package-spec pull request or branch for completeness and correctness. Use when the user asks to review a PR, check their branch is ready to merge, verify they have not missed required changes, or wants a pre-submission checklist. Accepts a PR number,…open-pull-requestDrafts or opens a GitHub pull request body that matches this repository’s .github/PULL_REQUEST_TEMPLATE.md, keeps What/Why concise, and fills Related issues with links to issues, PRs, or other repos. Use when the user asks to open a PR, create a pull request,…
ecs-pr-triageTriages an ECS pull request. Analyzes the PR diff and metadata, classifies the change (schema / tooling / docs / mixed), routes it to the correct contribution path (direct PR vs RFC Proposal vs needs-discussion), checks PR completeness, and produces a…ecs-rfc-guideGuides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping. Use when a change needs an RFC, when drafting or reviewing RFC PRs, or when…
migrate-required-input-dependencyMigrate an Elastic integration package from a legacy inline agent template to integrations with required input dependencies (`requires.input`, `streams[].package`). Gathers developer decisions on dataset naming, variable overrides, stack constraints, and…validate-integration-docsLint an Elastic integration package's markdown with vale and propose fixes. Use when the user says "vale check," "lint docs," "validate the README," "check integration markdown," or wants to polish an integration's docs before opening a PR. Filters out false…
docs-hub-kibanaMaintain and update the Kibana product hub at products/kibana.md. Use when editing the Kibana hub, get-started steps, solutions cards, Explore Kibana sections, or link-card lists, or when the user asks to add, remove, or rebalance hub links. Checks search and…docs-hub-whats-newRefresh the What's new cards on Elastic product hub pages. Use when updating hub-whats-new.yml after a stack release, or when the user asks to refresh hub What's new content.
add-packageUse this skill when adding a new package to the esql-js pnpm workspaces monorepo — either splitting an existing subsystem out of packages/esql/ (unbundling) or creating a brand-new package. Covers every config file the package needs (build, tests, storybook),…grammar-sync-updateUse this skill when a grammar sync PR has landed (updating packages/esql/src/parser/antlr/) and a follow-up PR is needed to wire a new ES|QL command or update an existing one in the AST layer. Covers all files that need changes and the exact patterns to…