메뉴
Analyze logs, metrics, traces, and APM data. Use when troubleshooting issues, finding errors, analyzing performance, investigating incidents, or checking error rates and latency.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Master index of all Moltler/elastic-script capabilities. Use first when uncertain which skill applies, when the user asks "what can you do", or to find the right skill for a task involving Elasticsearch, observability, security, ML, or integrations.
Manage Elasticsearch Streams for data routing, field extraction, and retention. Use when working with data streams, partitioning data into child streams, extracting fields from logs, configuring data lifecycle, or routing observability data.
Query metrics using PromQL syntax in ES|QL. Use when analyzing Prometheus-style metrics, calculating rates, histograms, quantiles, or when the user mentions PromQL, Prometheus, rate(), sum(), histogram_quantile(), or metric queries.
Manage alerts, notifications, SLOs, and incident response. Use when creating alert rules, viewing active alerts, sending Slack or PagerDuty notifications, managing SLOs, or automating incident response.
Quick start guide for Elasticsearch capabilities. Use when the user is new, asks "what can you do with Elasticsearch", wants to see available functions, or needs help getting oriented with Moltler skills.
Integrate with external services including AWS, Kubernetes, CI/CD, Terraform, and webhooks. Use when triggering external actions, automating cross-system workflows, or syncing data with external services.
| name | analyzing-observability |
| description | Analyze logs, metrics, traces, and APM data. Use when troubleshooting issues, finding errors, analyzing performance, investigating incidents, or checking error rates and latency. |
-- Recent errors
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 1 HOUR
| WHERE level = 'ERROR' OR log.level = 'error'
| SORT @timestamp DESC
| LIMIT 50;
-- Errors by service
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 24 HOURS AND level = 'ERROR'
| STATS error_count = COUNT(*) BY service.name
| SORT error_count DESC;
-- Top error messages
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 1 HOUR AND level = 'ERROR'
| STATS count = COUNT(*) BY message
| SORT count DESC | LIMIT 20;
-- CPU by host
ESQL FROM metrics-*
| WHERE @timestamp > NOW() - 1 HOUR AND metricset.name = 'cpu'
| STATS avg_cpu = AVG(system.cpu.total.pct) BY host.name
| SORT avg_cpu DESC;
-- High memory
ESQL FROM metrics-*
| WHERE metricset.name = 'memory'
| STATS avg_mem = AVG(system.memory.used.pct) BY host.name
| WHERE avg_mem > 80;
-- Disk check
ESQL FROM metrics-*
| WHERE metricset.name = 'filesystem'
| STATS used_pct = AVG(system.filesystem.used.pct) BY host.name, system.filesystem.mount_point
| WHERE used_pct > 85;
-- Slow transactions (>5s)
ESQL FROM traces-apm*
| WHERE @timestamp > NOW() - 1 HOUR
| WHERE transaction.duration.us > 5000000
| SORT transaction.duration.us DESC | LIMIT 20;
-- Error rate by service
ESQL FROM traces-apm*
| WHERE @timestamp > NOW() - 1 HOUR
| STATS total = COUNT(*), errors = SUM(CASE WHEN event.outcome = 'failure' THEN 1 ELSE 0 END) BY service.name
| EVAL error_rate = errors * 100.0 / total
| SORT error_rate DESC;
| Function | Description |
|---|---|
KIBANA_APM_SERVICES() | List services |
KIBANA_APM_SERVICE_TRANSACTIONS(service) | Transactions |
KIBANA_APM_SERVICE_ERRORS(service) | Errors |
KIBANA_APM_TRACE(trace_id) | Trace details |
| Skill | Description |
|---|---|
RUN SKILL get_recent_errors(minutes, limit) | Find errors |
RUN SKILL count_logs_by_level(index, hours) | Level distribution |
RUN SKILL list_apm_services() | List services |
RUN SKILL get_slow_transactions(threshold_ms) | Slow transactions |
DECLARE error_count NUMBER;
ESQL FROM logs-* | WHERE @timestamp > NOW() - 5 MINUTES AND level = 'ERROR' | STATS count = COUNT(*) INTO error_count;
IF error_count > 100 THEN
SLACK_SEND('#alerts', 'High error rate: ' || error_count || ' in 5 min');
END IF;