By name: elasticsearch description: Query and analyze Elasticsearch data including logs, indices, mappings, and cluster health using ES|QL
Elasticsearch Observability Skill
You have access to the Elasticsearch MCP server tools for querying and analyzing data from Elasticsearch clusters.
Available Tools
| Tool | Purpose |
|---|---|
| list_indices | List all available Elasticsearch indices |
| get_mappings | Get field mappings for a specific index |
| search | Perform searches using Elasticsearch Query DSL |
| esql | Execute ES |
| get_shards | Get shard information and cluster health status |
Workflow
- Understand the request — Determine what Elasticsearch data the user needs
- Discover indices — Use
list_indicesto find relevant data sources - Check mappings — Use
get_mappingsto understand available fields - Query data — Use
search(Query DSL) oresql(ES|QL) to retrieve results - Check health — Use
get_shardsfor cluster and index health information - Analyze results — Summarize findings with actionable recommendations
Best Practices
- Always start by listing indices to discover available data sources
- Check field mappings before writing queries to ensure correct field names
- Use ES|QL for complex aggregations and data exploration
- Use Query DSL search for precise filtering and full-text search
- Start with smaller timeframes and add LIMIT to optimize query performance
- Prefer safe, bounded queries — include explicit time filters
- Do not fabricate index names or field names; discover them first