菜单
Manage ILM policies, data streams, snapshots, and ingest pipelines. Use when configuring data retention, creating backups, restoring data, setting up data streams, or configuring data processing pipelines.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | managing-data-lifecycle |
| description | Manage ILM policies, data streams, snapshots, and ingest pipelines. Use when configuring data retention, creating backups, restoring data, setting up data streams, or configuring data processing pipelines. |
| Function | Example |
|---|---|
ES_ILM_GET_POLICY(policy?) | ES_ILM_GET_POLICY('logs-policy') |
ES_ILM_PUT_POLICY(name, policy) | Create policy |
ES_ILM_DELETE_POLICY(name) | Delete policy |
ES_ILM_EXPLAIN(index) | ES_ILM_EXPLAIN('logs-*') |
ES_ILM_RETRY(index) | Retry failed step |
ES_ILM_STATUS() / ES_ILM_START() / ES_ILM_STOP() | Control ILM |
SET result = ES_ILM_PUT_POLICY('logs-30d', {
'policy': {
'phases': {
'hot': {'actions': {'rollover': {'max_primary_shard_size': '50gb', 'max_age': '1d'}}},
'warm': {'min_age': '7d', 'actions': {'shrink': {'number_of_shards': 1}}},
'delete': {'min_age': '30d', 'actions': {'delete': {}}}
}
}
});
| Function | Example |
|---|---|
ES_CREATE_DATA_STREAM(name) | Create stream |
ES_DELETE_DATA_STREAM(name) | Delete stream |
ES_GET_DATA_STREAM(name?) | Get info |
ES_DATA_STREAM_STATS(name?) | Statistics |
| Function | Example |
|---|---|
ES_GET_REPOSITORIES(repo?) | List repos |
ES_CREATE_REPOSITORY(name, config) | Create repo |
ES_GET_SNAPSHOTS(repo, snapshot?) | List snapshots |
ES_CREATE_SNAPSHOT(repo, name, config?) | Create snapshot |
ES_DELETE_SNAPSHOT(repo, name) | Delete snapshot |
ES_RESTORE_SNAPSHOT(repo, name, config?) | Restore |
ES_SNAPSHOT_STATUS(repo?, snapshot?) | Status |
-- Create snapshot
SET snapshot = ES_CREATE_SNAPSHOT('s3-backup', 'daily-' || CURRENT_DATE(), {
'indices': 'logs-*,metrics-*',
'ignore_unavailable': TRUE
});
| Function | Example |
|---|---|
ES_GET_PIPELINE(id?) | Get pipelines |
ES_PUT_PIPELINE(id, config) | Create pipeline |
ES_DELETE_PIPELINE(id) | Delete pipeline |
ES_SIMULATE_PIPELINE(id?, docs, pipeline?) | Test |
ES_GROK_PATTERNS() | List grok patterns |
| Skill | Description |
|---|---|
RUN SKILL ilm_explain_status(index) | ILM status |
RUN SKILL create_snapshot_backup(repo, indices) | Create backup |
RUN SKILL list_snapshots(repo) | List snapshots |
Master index of all Moltler/elastic-script capabilities. Use first when uncertain which skill applies, when the user asks "what can you do", or to find the right skill for a task involving Elasticsearch, observability, security, ML, or integrations.
Manage Elasticsearch Streams for data routing, field extraction, and retention. Use when working with data streams, partitioning data into child streams, extracting fields from logs, configuring data lifecycle, or routing observability data.
Query metrics using PromQL syntax in ES|QL. Use when analyzing Prometheus-style metrics, calculating rates, histograms, quantiles, or when the user mentions PromQL, Prometheus, rate(), sum(), histogram_quantile(), or metric queries.
Manage alerts, notifications, SLOs, and incident response. Use when creating alert rules, viewing active alerts, sending Slack or PagerDuty notifications, managing SLOs, or automating incident response.
Analyze logs, metrics, traces, and APM data. Use when troubleshooting issues, finding errors, analyzing performance, investigating incidents, or checking error rates and latency.
Quick start guide for Elasticsearch capabilities. Use when the user is new, asks "what can you do with Elasticsearch", wants to see available functions, or needs help getting oriented with Moltler skills.