메뉴
Execute searches, aggregations, and queries. Use when finding documents, running analytics, counting records, exploring data, or performing semantic search with vectors.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Master index of all Moltler/elastic-script capabilities. Use first when uncertain which skill applies, when the user asks "what can you do", or to find the right skill for a task involving Elasticsearch, observability, security, ML, or integrations.
Manage Elasticsearch Streams for data routing, field extraction, and retention. Use when working with data streams, partitioning data into child streams, extracting fields from logs, configuring data lifecycle, or routing observability data.
Query metrics using PromQL syntax in ES|QL. Use when analyzing Prometheus-style metrics, calculating rates, histograms, quantiles, or when the user mentions PromQL, Prometheus, rate(), sum(), histogram_quantile(), or metric queries.
Manage alerts, notifications, SLOs, and incident response. Use when creating alert rules, viewing active alerts, sending Slack or PagerDuty notifications, managing SLOs, or automating incident response.
Analyze logs, metrics, traces, and APM data. Use when troubleshooting issues, finding errors, analyzing performance, investigating incidents, or checking error rates and latency.
Quick start guide for Elasticsearch capabilities. Use when the user is new, asks "what can you do with Elasticsearch", wants to see available functions, or needs help getting oriented with Moltler skills.
| name | searching-data |
| description | Execute searches, aggregations, and queries. Use when finding documents, running analytics, counting records, exploring data, or performing semantic search with vectors. |
-- Simple query
ESQL FROM logs-* | WHERE level = 'ERROR' | LIMIT 10;
-- Aggregations
ESQL FROM metrics-*
| STATS avg_cpu = AVG(cpu_percent), max_mem = MAX(memory_percent) BY host.name
| SORT avg_cpu DESC;
-- Time filtering
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 1 HOUR
| WHERE message LIKE '*error*'
| LIMIT 100;
| Function | Example |
|---|---|
ES_SEARCH(index, query) | ES_SEARCH('logs', {'query': {...}}) |
ES_COUNT(index, query?) | ES_COUNT('logs', {'query': {...}}) |
ES_MSEARCH(requests) | Multi-search |
ES_SCROLL(index, query, size) | Large result sets |
ES_KNN_SEARCH(index, vector, k) | Vector similarity |
| Function | Example |
|---|---|
ES_TERMS_AGG(index, field, size) | ES_TERMS_AGG('logs', 'level', 10) |
ES_STATS_AGG(index, field) | ES_STATS_AGG('metrics', 'cpu_percent') |
ES_DATE_HISTOGRAM(index, field, interval) | Time buckets |
DECLARE results DOCUMENT;
SET results = ES_SEARCH('documents', {
'query': {
'multi_match': {
'query': 'kubernetes deployment error',
'fields': ['title', 'body', 'tags']
}
}
});
SET similar = ES_KNN_SEARCH('embeddings',
INFERENCE_EMBED('embedding-model', 'query text'),
10
);
| Skill | Description |
|---|---|
RUN SKILL search_documents(index, query, size) | Paginated search |
RUN SKILL top_values(index, field, n) | Top N values |
RUN SKILL count_by_field(index, field) | Distribution |