菜单
Load when investigating production errors, latency, or trace data that requires querying Elasticsearch/APM directly — index patterns, field names, auth setup, and time-range syntax. Use before hand-rolling a query DSL call or guessing field names.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
OpenCode agent runtime — manage sessions, dispatch tasks, repair DB issues, and reset diffs
Look up people, projects, products, and decisions locally first: contact info (email, Slack ID, GitHub handle), titles and teams, project/product status, who works on what, and past decisions. Check before searching Slack, email, calendar, or GitHub — this is the first stop for any contact detail, project context, or decision-history question.
Load when reviewing a diff, naming a code smell or anti-pattern, deciding refactoring direction, or grading review-comment severity. Required reading when a named pattern is cited — load explicitly rather than paraphrasing from memory.
Load before creating, restacking, or landing a branch in a git-spice–managed stack — branch naming, stack navigation, and conflict/restack recovery. Use instead of raw git commands whenever the repo has a git-spice stack.
Manage dotfiles via chezmoi — apply safely, destroy files, manage LaunchAgents and externals, config and template gotchas
Communication style, audience awareness, and AI-authorship markers for human-facing prose — load when composing chat messages, review comments, merge request descriptions, emails, doc bodies, or ticket descriptions
基于 SOC 职业分类
| name | elasticsearch |
| description | Load when investigating production errors, latency, or trace data that requires querying Elasticsearch/APM directly — index patterns, field names, auth setup, and time-range syntax. Use before hand-rolling a query DSL call or guessing field names. |
| license | MIT |
Query application logs, APM traces, and errors using the Elasticsearch REST API directly.
Endpoint: $ES_URL — base URL varies per environment.
Pass time_range as a string like 15m, 1h, 24h, 7d. Translates to now-{value}{unit} in ES range filters.
Search application logs. Index: logs-*. Sorted by @timestamp desc.
POST logs-*/_search
{"query":{"bool":{"must":[{"query_string":{"query":"YOUR LUCENE QUERY HERE"}},{"range":{"@timestamp":{"gte":"now-1h"}}}]}},"_source":["@timestamp","message","log.level","service.name","trace.id"],"sort":[{"@timestamp":"desc"}],"size":100}
Response fields: .hits.hits[]._source — extract @timestamp, log.level, service.name, message.
Add a service filter by inserting a term clause into the must array:
{"term": {"service.name": "my-service"}}
Find slow transactions. Index: traces-apm*. Sorted by duration desc.
POST traces-apm*/_search
{"query":{"bool":{"must":[{"range":{"@timestamp":{"gte":"now-1h"}}},{"range":{"transaction.duration.us":{"gte":500000}}}]}},"_source":["@timestamp","service.name","transaction.name","transaction.duration.us","transaction.result","trace.id"],"sort":[{"transaction.duration.us":"desc"}],"size":50}
Response fields: .hits.hits[]._source — extract @timestamp, service.name, transaction.name, transaction.duration.us (microseconds), transaction.result.
Find exceptions and error groups. Index: logs-apm.error-*. Sorted by @timestamp desc.
POST logs-apm.error-*/_search
{"query":{"bool":{"must":[{"exists":{"field":"error.exception"}},{"range":{"@timestamp":{"gte":"now-1h"}}}]}},"_source":["@timestamp","error.exception.type","error.exception.message","error.grouping_key","service.name","transaction.name"],"sort":[{"@timestamp":"desc"}],"size":50}
Response fields: .hits.hits[]._source — extract @timestamp, error.exception.type, error.exception.message, service.name.
query_string uses Lucene syntax: error AND timeout, level:ERROR, message:"connection refused","aggs":{"by_svc":{"terms":{"field":"service.name","size":10}}} to the query JSON and read .aggregations.by_svc.bucketstrace.id links logs ↔ traces ↔ errors across indicesPUT /api/saved_objects/dashboard/:id replaces ALL attributes. Read the full object first, modify only panelsJSON, and write everything back including controlGroupInput, optionsJSON, etc. Omitting any attribute silently breaks panels.PUT /api/saved_objects/index-pattern/:id wipes the fields attribute if you only set title/timeFieldName. To recreate safely, delete and use POST /api/data_views/data_view which auto-discovers fields.index-pattern saved object render blank if that object is corrupted. The resilient pattern is adHocDataViews + internalReferences inside embeddableConfig.attributes.state — self-contained, no external saved-object dependency._update cannot change pivot. Must stop, delete, recreate. If the dest index has historical data from rolled-over source indices, check _snapshot first.