Kibana Context Engine

ElasticOfficialCreated by elastic

Skill
Tool integration
Data and AI
Apache-2.0
No issues found

From the author

Query Elastic Context Engine AI Indices, and the Knowledge Indicators (KIs) they store. Use when asked to search, explore, count, or answer questions from an AI Index / KI / Context Engine knowledge index, and when writing the ES|QL that queries one.

— the description by elastic

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The kibana-context-engine skill enables agents to interact with Elastic Context Engine AI Indices. It provides a structured approach to discovering, describing, and querying Knowledge Indicators (KIs) stored in Elasticsearch. By utilizing the elastic CLI, the skill ensures that queries respect space scoping, lifecycle management (such as filtering out expired or deleted items), and proper data retrieval patterns, allowing agents to retrieve context-aware information for downstream tasks.

What it does

Lists available AI Indices registered within a specific Kibana space.
Describes AI Index schemas, including fields, semantic mappings, and example queries.
Executes ES|QL queries against AI Indices to retrieve relevant Knowledge Indicators.
Handles lifecycle filtering automatically to return only active, unexpired knowledge.
Maps HTTP-shorthand operations to the required elastic CLI commands.

When to use it

When you need to search or answer questions using knowledge stored in an AI Index.
When you need to explore the structure or content of available AI Indices.
When you need to write and execute ES|QL queries specifically for Context Engine indices.
When you need to investigate specific Knowledge Indicators by type, tag, or content.

Advantages

Ensures queries are correctly scoped to the user's Kibana space.
Automatically applies lifecycle filters to exclude deleted or expired knowledge.
Provides a standardized workflow (list, describe, query) to prevent common errors.
Leverages native ES|QL for powerful, flexible data retrieval.

Usage examples

“Find the available AI indices in this space.”: The agent lists the registered AI indices, providing their IDs and descriptions to help identify the correct target for further queries.
“What fields are available in the sales-knowledge index?”: The agent calls the describe operation to retrieve the schema, field types, and example queries for the specified index.
“Search for the refund policy in the sales-knowledge index.”: The agent constructs and executes an ES|QL query using the index's specific fields to retrieve relevant Knowledge Indicators.
“Count how many detection KIs are in the security-index.”: The agent runs an aggregation query to return a count of KIs grouped by their type, confirming the index content.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/elastic/kibana-context-engine/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip kibana-context-engine.zip -d .agents/skills

Documentation by elastic

Query Context Engine AI Indices

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.

Concepts

AI Index — an Elasticsearch index named ai-index-idx-*, or a data stream named ai-index-ds-*, registered with the Context Engine under a logical id. The registration lives in Kibana; the knowledge lives in the backing index. Only the list operation knows which ai-index-* indices are registered and what to put in FROM; the index name alone does not tell you.

Knowledge Indicator (KI) — one document in an AI Index: context prepared for agents, such as a description of some data, a summary, an access pattern, a runnable query, or a record of a Kibana resource. A KI may answer a question outright, or help you locate and use the source that does.

A KI is retired by a tombstone (governance.lifecycle.status: deleted) or by an expires_at in the past. On a data stream, one KI is several revisions under the same id, the newest of which is its current state. The query API returns only current, active, unexpired KIs unless the query asks otherwise (see Lifecycle).

Search the AI Indices before broader retrieval whenever their KIs may cover the question. This skill reads KIs; generating them belongs to the Context Engine's automations and feedback loop.

Three read-only Context Engine HTTP APIs back this skill. The Operations table maps each to its elastic CLI command:

Operation	HTTP API (shorthand)	Input	Returns
List	`GET kbn:/api/context_engine/ai_index`	—	`{ ai_indices: [{ id, description, managed, dest: { type, value } }] }`
Describe	`GET kbn:/api/context_engine/ai_index/{aiIndexId}/_describe`	`aiIndexId` in the path	`{ response }`, a free-form context block (fields, counts, examples)
Query	`POST kbn:/api/context_engine/ai_index/_query`	`{ query, params?, limit? }`	`{ columns, values }`, ES\|QL rows

Use them in this order: list → describe → query. Never guess an index id, a FROM target, or a field name; describe supplies all three. Nothing else can read an AI Index correctly: a generic ES|QL query (POST /_query) or index listing neither knows which indices are registered nor applies the space scoping.

Every call is scoped to one space, and the space comes from the request rather than from anything written into the query. Point the request at another space to read that space's KIs.

The canonical KI schema

Elastic's canonical KI indices share these fields. Other AI Indices differ, so treat this as a starting shape and let describe settle the fields for any given index.

Field	ES\|QL type	Purpose
`type`	keyword	Categorization, e.g. `"index_metadata"`, `"document"`, `"entity_profile"`, `"detection"`
`title`	text	Short name of the KI or its backing entity
`description`	text	Short description of this KI
`content`	text	Full text: purpose, questions answered, access patterns
`tags`	keyword	Filter facets; multi-valued, so use `MATCH(tags, ?tag)` rather than `==`
`attributes`	flattened	Structured keyword-queryable metadata (status, themes, entity names). `attributes.esql` holds runnable ES\|QL
`expires_at`	date	Optional; a KI whose `expires_at` has passed is expired and hidden by default
`governance.lifecycle.status`	keyword	`deleted` marks a tombstone, hidden by default. On a data stream, only the newest revision's status counts
`governance.provenance.created_by.uri`	keyword	The automation that wrote the KI, as `workflow://<id>`

Semantic sub-fields use dot notation: title.semantic, description.semantic, content.semantic. They exist only where the mapping defines them; the describe block's Semantic fields section lists the real ones.

`attributes.esql` — a KI's runnable ES|QL

When a KI carries runnable ES|QL, it lives in attributes.esql. That is the canonical location; do not look elsewhere in attributes. The field is optional, so a query must tolerate its absence. The same access pattern is also presented as prose inside content — templates, params, and returns — so reach for content when a KI has no attributes.esql, or when the description of the query matters more than the query itself.

attributes is flattened, so extract the value with FIELD_EXTRACT before filtering or keeping it:

FROM <dest.value>
| WHERE governance.lifecycle.status IS NULL OR governance.lifecycle.status == "active"
| WHERE expires_at IS NULL OR expires_at > NOW()
| WHERE type == "detection"
| EVAL esql = FIELD_EXTRACT(attributes, "esql")
| WHERE esql IS NOT NULL
| KEEP title, description, esql
| LIMIT 5

A KI may store an array of queries, making the extracted value multivalued. IS NOT NULL still filters correctly, but scalar comparisons like == skip multivalued rows. Add | MV_EXPAND esql after the IS NOT NULL to get one row per query.

Flow

Step 1 — List the AI indices

Call GET kbn:/api/context_engine/ai_index. Each entry gives:

id, to pass to describe.
dest.value, the exact string to put after FROM. Use it verbatim: it differs from the id (sales-knowledge → ai-index-idx-sales-knowledge). dest.type says whether it is an index or a data_stream.
description and managed, to choose between entries.

The list is scoped to the caller's space and to what the caller can read. An entry whose backing index is empty or does not exist yet is still listed; an index the caller lacks read on is silently left out.

Skip this step when your instructions already name the index. Step 2 still applies: describe supplies the FROM target and the field names either way.

Step 2 — Describe the one you picked

Call GET kbn:/api/context_engine/ai_index/{aiIndexId}/_describe with the id from Step 1. The response is a text block meant to be read, not parsed: no regexing it into structured data. It contains:

the Query with ES|QL against: line (the FROM target),
Fields, every mapped field as path: type plus searchable / aggregatable (capped at 500; a path mapped inconsistently across matched indices shows as conflict),
Semantic fields, the searchable semantic_text fields, when any,
Knowledge item types and Tags, the top 20 KI type / tags values by document count in this space, active and unexpired only,
Example queries, three ready ES|QL shapes, each opening with the lifecycle pipeline for the index's destination type.

The block is capped at ~16k tokens. Read it and use it; do not echo it back to the user.

Step 3 — Query

Call POST kbn:/api/context_engine/ai_index/_query with { query, params?, limit? }. Build the ES|QL from the describe block's field list, starting from its example queries, and pass user input as named parameters (?query, ?type, ?tag) rather than interpolating it into the query string. The response is { columns, values }; summarize it for the user rather than dumping raw rows.

What the server owns and you cannot override:

Constraint	Behavior
Lifecycle filter	Inserted after `FROM` on any query that reads a registered AI Index: active and unexpired KIs only, newest revision per `id` on a data stream, `governance.*` dropped when the query does not name it. See Lifecycle.
Space filter	Applied server-side from the request. Never write a space condition into the query: yours does not replace the server's and can silently match nothing.
Row limit	`limit` defaults to 100, max 1000. A smaller trailing `LIMIT` in the query wins; a larger one is capped.
Query size	10,000 characters max
`params`	At most 100 entries; keys ≤256 chars, string values ≤4096 chars
Index access	The query's `FROM` decides what is read; Elasticsearch index privileges bound it. ES 4xx comes back as-is.

There is no time_range and no filter parameter. Express time windows in the ES|QL itself (WHERE @timestamp >= NOW() - 24 hours) or through params.

Lifecycle

Open every query with the two lifecycle filters, unless reading retired KIs, and end row-returning queries in KEEP (aggregations end in STATS): the query then reads as what it returns without pulling governance.* into context.

| WHERE governance.lifecycle.status IS NULL OR governance.lifecycle.status == "active"
| WHERE expires_at IS NULL OR expires_at > NOW()

The query API adds these two filters and DROP governance.* to any query that omits them, and on a data stream always keeps only the newest revision per id (adding METADATA _id, _index when missing). A top-level WHERE on a lifecycle field switches off that field's filter only; showing the field in KEEP does not. Any governance.* column named anywhere in the query, the opening status filter included, switches off the DROP, so a query that opens with the two filters returns governance.* columns unless it ends in KEEP or STATS. An index that is not registered as an AI Index is read as-is.

Examples

These run as-is against canonical KI indices. For any other AI Index, adapt the field names from the describe block: title.semantic does not exist unless the mapping has it.

Full-text search, lexical and semantic fused

FROM ai-index-idx-sales-knowledge METADATA _id, _index, _score
| WHERE governance.lifecycle.status IS NULL OR governance.lifecycle.status == "active"
| WHERE expires_at IS NULL OR expires_at > NOW()
| FORK
    ( WHERE MATCH(title, ?query) OR MATCH(description, ?query) OR MATCH(content, ?query) | SORT _score DESC | LIMIT 20 )
    ( WHERE MATCH(title.semantic, ?query) OR MATCH(description.semantic, ?query) OR MATCH(content.semantic, ?query) | SORT _score DESC | LIMIT 20 )
| FUSE
| SORT _score DESC, _id ASC
| KEEP title, description, content, type, tags
| LIMIT 5

Called with the search phrase as a parameter:

{ "query": "<the esql above>", "params": { "query": "refund policy for annual plans" }, "limit": 5 }

Filter by KI type and tag

FROM ai-index-idx-sales-knowledge
| WHERE governance.lifecycle.status IS NULL OR governance.lifecycle.status == "active"
| WHERE expires_at IS NULL OR expires_at > NOW()
| WHERE type == ?type AND MATCH(tags, ?tag)
| KEEP title, description, content, type, tags
| LIMIT 5

Count KIs by type

A first probe to confirm the index holds KIs visible from this space:

FROM ai-index-idx-sales-knowledge
| WHERE governance.lifecycle.status IS NULL OR governance.lifecycle.status == "active"
| WHERE expires_at IS NULL OR expires_at > NOW()
| STATS count = COUNT(*) BY type
| SORT count DESC
| LIMIT 20

Read retired KIs, only when asked

Only when the user asks about deleted or expired knowledge. Tombstoned and expired KIs stay readable, on an index or a data stream:

Tombstoned: a WHERE on governance.lifecycle.status turns off the status filter and, being a governance.* column, the DROP too; the expiry filter still applies.
Expired: a WHERE on expires_at turns off the expiry filter; the status filter still applies.

Nothing else is readable: a KI whose document was removed is gone, and older revisions on a data stream are never returned.

FROM ai-index-idx-sales-knowledge
| WHERE governance.lifecycle.status == "deleted"
| KEEP title, governance.provenance.created_by.uri
| LIMIT 20

On a data stream, the same query returns the KIs whose newest revision is a tombstone:

FROM ai-index-ds-sales-knowledge
| WHERE governance.lifecycle.status == "deleted"
| KEEP title, governance.provenance.created_by.uri
| LIMIT 20

Diagnosing

These failure modes look alike from the outside and have different fixes. Work down the table.

Symptom	Cause	Fix
`elastic kb context-engine` is not a known command	The installed `elastic` CLI predates the Context Engine commands	Update the `elastic` CLI
404 from every Context Engine call in one space	`contextEngine:enabled` is off in that space. Not a permissions problem	Turn it on in that space's advanced settings
404 from every Context Engine call on every space	Kibana predates the Context Engine APIs	Check the version against the compatibility note above
403 from every Context Engine call	Caller lacks the Context Engine `read` Kibana privilege	Add Context Engine `read` to the caller's role
403 from query or describe only	Missing Elasticsearch index privilege on the backing `ai-index-*` indices	Grant `read` (query) / `read` and `view_index_metadata` (describe)
Describe returns a block with no counts sections	`type`/`tags` are not aggregatable `keyword` fields, or no documents in this space	Expected; the rest of the block is still usable
An AI index you expect is not listed	No `read` on its backing index, or every document in it belongs to another space	Check privileges and the space the request is scoped to
`Unknown index` from a query whose id was listed	The AI Index is registered but its backing index does not exist yet	Expected for a registration with no data; pick another index
Error saying the query response is too large	The rows exceeded the 20 MB response cap	Narrow with `KEEP` (drop `content` and other large fields), lower `limit`, or aggregate with `STATS`
Query returns nothing but the index has data	Wrong space: the server-side space filter hides other spaces' documents	Scope the request to the right space
A KI you know exists is not returned	It is tombstoned, or its `expires_at` has passed	Filter on `governance.lifecycle.status` or `expires_at` in a `WHERE` to read it (see Lifecycle)
No `governance.*` columns in the result	The query names no `governance.*` column, or a `KEEP`/`STATS` leaves them out	Expected; name the field you need, e.g. in `KEEP`

Guidelines

Never skip describe. A query written from memory could fail, or silently returns nothing.
Read AI Indices only through POST kbn:/api/context_engine/ai_index/_query. A direct Elasticsearch query or a cluster-wide ES|QL query (POST /_query) bypasses the space scoping, the lifecycle filter, and the row cap: it returns every revision, deleted and expired ones included. Consult the elasticsearch-esql skill for ES|QL syntax.
Start at limit 5 and narrow the columns with KEEP. The whole result enters your context.
If the top 5 don't answer the question, check how they fall short: on topic but incomplete → raise the limit; off topic → the query is wrong, so reword the search terms or loosen the WHERE rather than asking for more rows.
Answer from the rows and cite the KI titles; do not dump the raw result.
An empty result means no current KI. Do not read tombstones or expired KIs unless the user asks about deleted or expired knowledge.

Out of scope

Creating, updating, or deleting AI indices, and managing their sources / automations / feedback_analysis config.
Generating Knowledge Indicators, or deciding what an AI Index should contain. That is the Context Engine's automations and its analyze-and-improve feedback loop, not query time.

Operations

HTTP API (shorthand)	`elastic` CLI command
`GET kbn:/api/context_engine/ai_index`	`elastic kb context-engine get-context-engine-ai-index`
`GET kbn:/api/context_engine/ai_index/{aiIndexId}/_describe`	`elastic kb context-engine get-context-engine-ai-index-aiindexid-describe --ai-index-id '<id>'`
`POST kbn:/api/context_engine/ai_index/_query`	`elastic kb context-engine post-context-engine-ai-index-query --query '<esql>' [--params '<json>'] [--limit <n>]`
`GET kbn:/api/context_engine/ai_index/{aiIndexId}`	`elastic kb context-engine get-context-engine-ai-index-aiindexid --ai-index-id '<id>'`

Files

ATTRIBUTION.mdAdded by AutoGineer972 B
LICENSELicence file added by AutoGineer11.1 KiB
SKILL.md21.1 KiB

LICENSE

                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

   END OF TERMS AND CONDITIONS

   APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright 2026 Elasticsearch BV

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

The author says: Kibana 9.6 or later with matching Elasticsearch, or an Elastic Serverless project, with the `contextEngine:enabled` advanced setting turned on in the target space. Runs against the Context Engine HTTP APIs through the `elastic` CLI. The caller needs Context Engine `read`, plus Elasticsearch `read` and `view_index_metadata` on the backing `ai-index-*` indices.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

elastic

Publisher

Elastic (Official)

Source

elastic/agent-skills · skills/kibana/kibana-context-engine · commit 09d879d

Licence

Apache License 2.0 (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

Also distributed in

elastic/agent-skills

AutoGineer is not affiliated with or endorsed by elastic or Elastic.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download kibana-context-engine.zip