Menu
Teach ES|QL query writing and when to use it
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.
| name | esql-guide |
| description | Teach ES|QL query writing and when to use it |
Use when the user wants to write or understand ES|QL (Elasticsearch Query Language) queries.
get_mappings or list_indices so the user knows index and field names.FROM index | WHERE ... | STATS ... | SORT ... | LIMIT n.esql_query to run the query.When writing ES|QL for Kibana dashboard panels, the column alias IS the display label:
STATS `Tank Level (%)` = AVG(field) not STATS avg_val = AVG(field). The alias appears as the metric subtitle, axis label, and table header.STATS `pH` = ROUND(AVG(field), 2) avoids showing 7.003575848691441 in KPIs.BY `Site` = \`attributes.site.name\` for clean breakdown legends instead of raw dotted field paths.BUCKET(@timestamp, 30 seconds). If data spans hours, use 5 minute. Too-large buckets collapse everything into one flat point.WHERE field IS NOT NULL prevents empty data points in time-series panels.time_series_metric: "counter" (e.g. metrics.sanitation.cycle_count) reject AVG/SUM/MAX. Cast first: EVAL c = TO_DOUBLE(counter_field) | STATS AVG(c).esql_query and show tabular output.