Observability K8s Investigation

When you're debugging Kubernetes issues and have Elastic's OpenTelemetry distribution running, this skill helps Claude correlate pod metrics, cluster events, and logs to track down root causes. It's scoped specifically to EDOT and the kube-stack collector's OTel indices, not the older Elastic Agent integration that's being phased out. The smart part is that it works across workload, node, and control plane layers using proper OTel semantic conventions. It won't help with APM service analysis or capacity planning, those are separate domains. With nearly a thousand installs and a passing security audit, it's clearly solving a real pain point for teams running Kubernetes observability through Elastic.

skills.sh installs: 3.3K
GitHub stars: 604
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill observability-k8s-investigation --agent claude-code

Installs into .claude/skills of the current project.

Files

Kubernetes Investigation

Diagnose Kubernetes issues using OTel telemetry collected via EDOT (Elastic Distribution of OpenTelemetry) and the kube-stack collector. Correlate cluster state, pod runtime metrics, K8s events, application logs, and APM to identify root cause across the workload, node, and control-plane layers.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.