菜单
Set up APM instrumentation and log shipping — framework-specific agents, Filebeat, Elastic Agent, and correlation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Debug and analyze LLM eval runs — view traces, compare runs, investigate failures, track costs. Use when debugging @kbn/evals failures, comparing eval runs, or analyzing LLM performance.
Start your security session with a personalized briefing — attacks, alerts, cases, rules, threat intel. Use as the first thing when starting security work.
Guide users from zero to a working Elastic cluster — Cloud or on-prem, connection config, first queries, and next steps.
Interactive guide for creating an APM service overview dashboard — discovers service data, presents metrics, and creates a tailored dashboard.
Interactive guide for creating SLOs from discovered APM and metric data — identifies candidates, lets user configure targets, and creates SLOs.
Create, configure, and manage Elasticsearch indices — mappings, settings, templates, data streams, and lifecycle policies.
| name | apm-log-shipping-setup |
| description | Set up APM instrumentation and log shipping — framework-specific agents, Filebeat, Elastic Agent, and correlation. |
Help users instrument applications with APM agents and configure log shipping for centralized observability.
Use when the user asks to:
Also activates on keywords: "APM agent", "Filebeat", "log shipping", "Elastic Agent", "instrumentation", "tracing", "OpenTelemetry"
Do NOT use when:
o11y-service-dashboard)o11y-slo-setup)o11y-full-setup, which orchestrates this skill)get_cluster_context — Cluster orientation and versionsetup_apm — Generate framework-specific APM instrumentation codesetup_log_shipping — Generate Filebeat/Elastic Agent configurationdiscover_o11y_data — Verify data is arriving after setupelasticsearch_api — Check indices, verify dataesql_query — Query APM and log dataCall get_cluster_context for cluster URL, version, and auth method.
Ask about:
Call setup_apm with the user's framework to generate:
ELASTIC_APM_SERVER_URL, ELASTIC_APM_SECRET_TOKEN, ELASTIC_APM_SERVICE_NAME)Key guidance:
service.name, service.version, and deployment.environmentCall setup_log_shipping with the user's log source to generate:
Key guidance:
message, log.level, service.name, trace.idtrace.id to log output for APM ↔ log correlationdecode_json_fields processorcontainer input with autodiscoverkubernetes providerConfigure correlation between APM traces and logs:
trace.id and span.id into application log contextMDCUtils.addTraceId())elasticapm structlog/logging processordiscover_o11y_data to check for new APM services and log sourcesesql_query to verify:
FROM traces-apm* | STATS count = COUNT(*) BY service.name | LIMIT 10FROM logs-* | WHERE service.name == "<name>" | SORT @timestamp DESC | LIMIT 5FROM logs-* | WHERE trace.id IS NOT NULL | LIMIT 5Suggest:
o11y-service-dashboard)o11y-slo-setup)ES_URL and ES_API_KEY configuredo11y-full-setup — Umbrella skill that orchestrates APM + logs + dashboards + SLOso11y-service-dashboard — Create dashboards after data is flowingo11y-slo-setup — Set up SLOs for the instrumented service