Elasticsearch Esql

This connects Claude to Elasticsearch's ES|QL query language, the piped syntax that replaced the old JSON DSL. It auto-detects whether you're on Serverless or a versioned cluster, pulls index schemas so you never guess field names, and handles the quirks like time series indices requiring TS syntax instead of FROM. Useful for log analysis, metrics aggregation, and exploratory queries when you want natural language over manual query construction. The skill knows about version-specific features like MATCH for full-text search and LOOKUP JOIN for enrichment, falling back gracefully on older clusters. Ships with detailed references on time series queries and search strategies if you need to understand what it's generating.

skills.sh installs: 5.2K
GitHub stars: 604
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill elasticsearch-esql --agent claude-code

Installs into .claude/skills of the current project.

Files

Elasticsearch ES|QL

Execute ES|QL queries against Elasticsearch: discover the schema, choose the right ES|QL feature for the task, generate the simplest correct query, and run it.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.