elastic avatar

Kibana Agent Builder

If you're managing Elastic's Agent Builder in Kibana, this handles the full lifecycle: creating agents, updating them, deleting them, and testing chat interactions. It also covers custom tool management for ES|QL queries, index searches, and workflows. You'll need your Kibana URL and either an API key or username/password combo to authenticate. The skill can pull from user arguments for agent names, which is handy for scripting. It's focused stuff, no fluff. If you're already in the Elastic ecosystem and building conversational agents on top of your data, this saves you from writing your own API wrappers around Kibana's Agent Builder endpoints.

skills.sh installs
4.3K
GitHub stars
604
last updated
Aug 21, 2026

Install

$ npx -y skills add elastic/agent-skills --skill kibana-agent-builder --agent claude-code

Installs into .claude/skills of the current project.

Files

Kibana Agent Builder

Create, inspect, update, delete, and test Agent Builder tools and agents. Ground LLM responses in Elasticsearch data through scoped search tools, parameterized ES|QL, and workflow integrations.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.

Resource model

Agent Builder exposes three distinct resource kinds — do not conflate them:

Sponsors

Details

Repository
github.com/elastic/agent-skills
Categories
Testing & QA, AI & Agent Building
First seen
May 16, 2026

More from elastic/agent-skills

All 57
1dotnet avatarcrap-scoredotnet/skillsCalculates targeted CRAP (Change Risk Anti-Patterns) scores for a named .NET method, class, or single source file. Use when the user explicitly asks to compute 4.2Kskills.sh installs
2elastic avatarsecurity-generate-security-sample-dataelastic/agent-skillsGenerate sample security events, attack scenarios, and synthetic alerts for Elastic Security. Use when demoing, populating dashboards, testing detection rules, 4.1Kskills.sh installs
3yaklang avatarauthbypass-authentication-flawsyaklang/hack-skillsAuthentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force re4Kskills.sh installs
4yaklang avatarapi-auth-and-jwt-abuseyaklang/hack-skillsAPI authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses4Kskills.sh installs
5sanity-io avatarcontent-experimentation-best-practicessanity-io/agent-toolkitContent experimentation and A/B testing guidance covering experiment design, hypotheses, metrics, sample size, statistical foundations, CMS-managed variants, an4Kskills.sh installs
6yaklang avatarapi-authorization-and-bolayaklang/hack-skillsAPI authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authoriza3.9Kskills.sh installs