Kibana Anomaly Detection

This is a thorough implementation of Elastic ML anomaly detection workflows through Kibana's Agent Builder MCP surface. It ships with four distinct modes (Investigate, Explain, Troubleshoot, Manage) that map user intent to specific tool chains, so you don't waste time blending RCA logic with score explanation or job configuration. The investigation protocol is concrete: 14 steps from metadata discovery through cross-job entity correlation to source evidence retrieval, with clear rules like "multi-job entities are prime suspects" and "earliest anomaly timestamp wins." The skill understands renormalization, multi-bucket impact scoring, and the three-layer structure of the `.ml-anomalies-*` indices. You'll want this when answering "what broke and which entity caused it" or debugging why a datafeed stopped, not for general Elasticsearch queries.

skills.sh installs: 3.4K
GitHub stars: 604
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill kibana-anomaly-detection --agent claude-code

Installs into .claude/skills of the current project.

Files

Elastic ML Anomaly Detection

Expert process for ML anomaly detection: attribute incidents to entities, explain scores and model behavior, diagnose job lifecycle failures, and manage jobs. Read anomaly results from POST /.ml-anomalies-*/_search (Serverless-safe) and job/datafeed state from ML REST APIs. When the user embeds fixture evidence (influencer rows, job stats) in the prompt, apply the judgment below directly — do not re-fetch fields already supplied.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.

SKILL.md on GitHub

Details

Repository: github.com/elastic/agent-skills
Categories: Documentation, AI & Agent Building, Data Science & ML, Debugging
First seen: Jun 11, 2026