Observability K8s Investigation

When your Kubernetes pods are crashing or your nodes are under pressure, this skill correlates OTel telemetry from EDOT's kube-stack collector to find the root cause. It pulls from kubeletstats, k8scluster, and k8sevents receivers to connect runtime metrics, cluster state, and Kubernetes events. The documentation is refreshingly honest about common misdiagnoses: it warns you that OOMKilled doesn't automatically mean memory leak, that average CPU hides throttling pain, and that empty results mean missing data, not healthy systems. It's scoped strictly to the OTel ingestion path and explicitly excludes the legacy Elastic Agent integration, so you won't waste time querying deprecated indices.

GitHub stars: 503
last updated: Jun 1, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill observability-k8s-investigation --agent claude-code

Installs into .claude/skills of the current project.

Files

Kubernetes Investigation

Diagnose Kubernetes issues using OTel telemetry collected via EDOT (Elastic Distribution of OpenTelemetry) and the kube-stack collector. Correlate cluster state, pod runtime metrics, K8s events, application logs, and APM to identify root cause across the workload, node, and control-plane layers.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.