菜单
Analyze logs, metrics, traces, and APM data. Use when troubleshooting issues, finding errors, analyzing performance, investigating incidents, or checking error rates and latency.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Master index of all Moltler/elastic-script capabilities. Use first when uncertain which skill applies, when the user asks "what can you do", or to find the right skill for a task involving Elasticsearch, observability, security, ML, or integrations.
Manage Elasticsearch Streams for data routing, field extraction, and retention. Use when working with data streams, partitioning data into child streams, extracting fields from logs, configuring data lifecycle, or routing observability data.
Query metrics using PromQL syntax in ES|QL. Use when analyzing Prometheus-style metrics, calculating rates, histograms, quantiles, or when the user mentions PromQL, Prometheus, rate(), sum(), histogram_quantile(), or metric queries.
Manage alerts, notifications, SLOs, and incident response. Use when creating alert rules, viewing active alerts, sending Slack or PagerDuty notifications, managing SLOs, or automating incident response.
Quick start guide for Elasticsearch capabilities. Use when the user is new, asks "what can you do with Elasticsearch", wants to see available functions, or needs help getting oriented with Moltler skills.
Integrate with external services including AWS, Kubernetes, CI/CD, Terraform, and webhooks. Use when triggering external actions, automating cross-system workflows, or syncing data with external services.
| name | analyzing-observability |
| description | Analyze logs, metrics, traces, and APM data. Use when troubleshooting issues, finding errors, analyzing performance, investigating incidents, or checking error rates and latency. |
-- Recent errors
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 1 HOUR
| WHERE level = 'ERROR' OR log.level = 'error'
| SORT @timestamp DESC
| LIMIT 50;
-- Errors by service
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 24 HOURS AND level = 'ERROR'
| STATS error_count = COUNT(*) BY service.name
| SORT error_count DESC;
-- Top error messages
ESQL FROM logs-*
| WHERE @timestamp > NOW() - 1 HOUR AND level = 'ERROR'
| STATS count = COUNT(*) BY message
| SORT count DESC | LIMIT 20;
-- CPU by host
ESQL FROM metrics-*
| WHERE @timestamp > NOW() - 1 HOUR AND metricset.name = 'cpu'
| STATS avg_cpu = AVG(system.cpu.total.pct) BY host.name
| SORT avg_cpu DESC;
-- High memory
ESQL FROM metrics-*
| WHERE metricset.name = 'memory'
| STATS avg_mem = AVG(system.memory.used.pct) BY host.name
| WHERE avg_mem > 80;
-- Disk check
ESQL FROM metrics-*
| WHERE metricset.name = 'filesystem'
| STATS used_pct = AVG(system.filesystem.used.pct) BY host.name, system.filesystem.mount_point
| WHERE used_pct > 85;
-- Slow transactions (>5s)
ESQL FROM traces-apm*
| WHERE @timestamp > NOW() - 1 HOUR
| WHERE transaction.duration.us > 5000000
| SORT transaction.duration.us DESC | LIMIT 20;
-- Error rate by service
ESQL FROM traces-apm*
| WHERE @timestamp > NOW() - 1 HOUR
| STATS total = COUNT(*), errors = SUM(CASE WHEN event.outcome = 'failure' THEN 1 ELSE 0 END) BY service.name
| EVAL error_rate = errors * 100.0 / total
| SORT error_rate DESC;
| Function | Description |
|---|---|
KIBANA_APM_SERVICES() | List services |
KIBANA_APM_SERVICE_TRANSACTIONS(service) | Transactions |
KIBANA_APM_SERVICE_ERRORS(service) | Errors |
KIBANA_APM_TRACE(trace_id) | Trace details |
| Skill | Description |
|---|---|
RUN SKILL get_recent_errors(minutes, limit) | Find errors |
RUN SKILL count_logs_by_level(index, hours) | Level distribution |
RUN SKILL list_apm_services() | List services |
RUN SKILL get_slow_transactions(threshold_ms) | Slow transactions |
DECLARE error_count NUMBER;
ESQL FROM logs-* | WHERE @timestamp > NOW() - 5 MINUTES AND level = 'ERROR' | STATS count = COUNT(*) INTO error_count;
IF error_count > 100 THEN
SLACK_SEND('#alerts', 'High error rate: ' || error_count || ' in 5 min');
END IF;