Skip to main content
affpapa.org
RU EN
skill CX Codex

input-configurations — Claude Code skill for Elastic input templates

A skill for building and reviewing input templates in Elastic integrations, from HTTPJSON and S3 to Journald and WebSocket. Federated Identity for AWS included.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add elastic/integration-skills --skill input-configurations -a claude-code
Open on GitHub

What input-configurations does

The skill walks through agent/stream/*.yml.hbs files for every input type except CEL. A routing table maps the filename to the right guide: httpjson.yml.hbs pulls the HTTPJSON reference, aws-s3.yml.hbs the S3 one, journald.yml.hbs the Journald one, and so on across fifteen types — CloudWatch, Azure Blob, Azure EventHub, GCS, GCP Pub/Sub, TCP, UDP, HTTP Endpoint, Filestream, Logfile, Winlog, WebSocket.

First read is mandatory: references/common-input-patterns.md. It holds what every input type shares — tags, processors passthrough, variable conventions, the forwarded / publisher_pipeline.disable_host coupling. Type-specific guides assume you have read it.

Federated Identity (Cloud Connectors) for agentless AWS integrations is a separate branch. It loads references/federated-identity-aws.md no matter which input type is in play, cel included. The auth.aws and use_cloud_connectors block on CEL stream templates belongs here; CEL program logic itself goes to the cel-programs skill. Manifest schema (var_groups, provider_permissions, format_version) is handed to package-spec, pipeline problems to ingest-pipelines, field mapping to ecs-field-mappings. Only one type guide loads at a time, so you are not wading through references you do not need.

What it helps with

  • write an agent/stream/*.yml.hbs template for a new input type
  • set up request, response, pagination, cursor and auth blocks in HTTPJSON
  • wire cloud storage collection for AWS S3, GCS, Azure Blob or Azure EventHub
  • configure network inputs: TCP, UDP, HTTP Endpoint, WebSocket
  • enable Federated Identity on an AWS integration package

Example prompts for the agent

  • Build an agent/stream/aws-s3.yml.hbs template for S3 bucket notifications
  • Check the pagination and cursor blocks in httpjson.yml.hbs
  • Set up auth.aws and use_cloud_connectors for an agentless AWS integration

How to install input-configurations

1Skills CLI (Vercel)

npx skills add elastic/integration-skills --skill input-configurations -a claude-code

2Manually: put the files in place

~/.claude/skills/input-configurations/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/input-configurations/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about input-configurations

How do I install input-configurations in Claude?

Run npx skills add elastic/integration-skills --skill input-configurations -a claude-code. The skill then lives at ~/.claude/skills/input-configurations/SKILL.md.

What does input-configurations do?

It guides the structure, pagination, authentication and variables of Elastic input templates for a given input type. It also covers Federated Identity for AWS.

How is it different from cel-programs?

CEL program logic lives in cel-programs. This skill owns the non-CEL input templates plus the auth.aws and use_cloud_connectors block on CEL stream templates for Federated Identity.

Source text

SKILL.md · Apache-2.0 
---
name: input-configurations
description: >-
  Input template configuration for Elastic integrations. Covers agent stream
  templates (agent/stream/*.yml.hbs) for all non-CEL input types: HTTPJSON,
  AWS S3, CloudWatch, Azure Blob, Azure EventHub, GCS, GCP Pub/Sub, TCP, UDP,
  HTTP Endpoint, Filestream, Logfile, Journald, Winlog, and WebSocket. Also
  covers Federated Identity (Cloud Connectors) for agentless AWS integrations,
  including the auth.aws / use_cloud_connectors block on CEL stream templates.
  For CEL program logic, use the cel-programs skill.
license: Apache-2.0
metadata:
  author: elastic
  version: "1.0"
---

# input-configurations

## When to use

Load this skill whenever tasks include:
- building, modifying, or reviewing `agent/stream/*.yml.hbs` templates for non-CEL input types
- configuring request, response, pagination, cursor, or authentication blocks in HTTPJSON templates
- wiring up cloud storage inputs (AWS S3, GCS, Azure Blob, Azure EventHub)
- setting up network inputs (TCP, UDP, HTTP Endpoint, WebSocket)
- configuring file-based inputs (Filestream, Logfile, Journald, Winlog)
- enabling Federated Identity (Cloud Connectors) on an AWS integration package

## When not to use

Do not use this skill as the primary guide for:
- CEL *program* development (`cel-programs`) -- CEL program structure, state model, and mito workflow. Exception: the `auth.aws` / `use_cloud_connectors` template block for Federated Identity is owned here via `references/federated-identity-aws.md`
- ingest pipeline processor design (`ingest-pipelines`)
- field mappings and ECS compliance (`ecs-field-mappings`)
- `var_groups` / `provider_permissions` *schema* and `format_version` floors alone (`package-spec`) -- use this skill for the end-to-end federation procedure that applies them

## Mandatory first read

**Always load `references/common-input-patterns.md` first.** It covers patterns that apply to every input type (tags, processors passthrough, variable conventions, `forwarded`/`publisher_pipeline.disable_host` coupling). These patterns are prerequisites for all type-specific guides.

## Type routing table

Detect the input type from the filename pattern in `agent/stream/` or from the data stream manifest `input:` field, then load the matching guide.

| Input type | Filename pattern | Guide |
|---|---|---|
| HTTPJSON | `httpjson.yml.hbs` | `references/httpjson-guide.md` |
| AWS S3 | `aws-s3.yml.hbs` | `references/aws-s3-guide.md` |
| CloudWatch | `aws-cloudwatch.yml.hbs` | `references/aws-cloudwatch-guide.md` |
| Azure Blob Storage | `azure-blob-storage.yml.hbs` | `references/azure-blob-storage-guide.md` |
| Azure Event Hub | `azure-eventhub.yml.hbs` | `references/azure-eventhub-guide.md` |
| GCS | `gcs.yml.hbs` | `references/gcs-guide.md` |
| GCP Pub/Sub | `gcp-pubsub.yml.hbs` | `references/gcp-pubsub-guide.md` |
| TCP | `tcp.yml.hbs` | `references/tcp-udp-guide.md` |
| UDP | `udp.yml.hbs` | `references/tcp-udp-guide.md` |
| HTTP Endpoint | `http_endpoint.yml.hbs` | `references/http-endpoint-guide.md` |
| Filestream | `filestream.yml.hbs` | `references/filestream-logfile-guide.md` |
| Logfile | `log.yml.hbs` | `references/filestream-logfile-guide.md` |
| Journald | `journald.yml.hbs` | `references/journald-guide.md` |
| Winlog | `winlog.yml.hbs` | `references/winlog-guide.md` |
| WebSocket | `websocket.yml.hbs` | `references/websocket-guide.md` |

Load **only** the guide for the detected input type, not all guides.

For **Federated Identity** tasks (any eligible input type, including `cel`), load
`references/federated-identity-aws.md` regardless of which input type is
involved.

## Handoff

- For **CEL program logic**, hand off to the `cel-programs` skill. Keep this skill loaded for Federated Identity `auth.aws` / `use_cloud_connectors` edits on `cel.yml.hbs`.
- For **manifest schema** (`var_groups`, `provider_permissions`, `format_version` / conditions floors), hand off to the `package-spec` skill (`references/var-groups-and-provider-permissions.md`).
- For **pipeline issues** discovered while reviewing input templates, hand off to the `ingest-pipelines` skill.
- For **field mapping issues** found in template variable wiring, hand off to the `ecs-field-mappings` skill.

## References

- `references/common-input-patterns.md` -- tags, processors passthrough, variable conventions, review flags (applies to ALL input types)
- `references/httpjson-guide.md` -- HTTPJSON template syntax, structure, validation rules, pagination patterns, authentication, cursor persistence
- `references/aws-s3-guide.md` -- S3 bucket/SQS notification collection
- `references/aws-cloudwatch-guide.md` -- CloudWatch log group collection
- `references/azure-blob-storage-guide.md` -- Azure Blob Storage collection
- `references/azure-eventhub-guide.md` -- Azure Event Hub collection
- `references/gcs-guide.md` -- Google Cloud Storage collection
- `references/gcp-pubsub-guide.md` -- GCP Pub/Sub collection
- `references/tcp-udp-guide.md` -- TCP and UDP (syslog-style) listeners
- `references/http-endpoint-guide.md` -- HTTP Endpoint (webhook receiver)
- `references/filestream-logfile-guide.md` -- Filestream and legacy Logfile inputs
- `references/journald-guide.md` -- Journald collection
- `references/winlog-guide.md` -- Windows Event Log collection
- `references/websocket-guide.md` -- WebSocket streaming (may embed CEL)
- `references/federated-identity-aws.md` -- AWS Federated Identity procedure: input classification, federation vars, `auth.aws` / `use_cloud_connectors`, input gating (schema lives in `package-spec`)

© elastic · Apache-2.0 · elastic/integration-skills

Similar skills

Everything for DevOps and infrastructure →
private-connectivity grafana Sets up private network connectivity to Grafana Cloud over AWS PrivateLink, Azure Private Link, GCP Private Service Connect and PDC. Useful when telemetry must stay off the public internet. CX Codex +1 4,100installs dt-obs-network-flows Dynatrace A Dynatrace skill that reads network flows from three sources and answers who talks to whom and where connections break. CX Codex +1 912installs cloud-architect https://github.com/Jeffallan A skill for designing cloud architectures on AWS, Azure and GCP: redundant topology, migration plan, cost model and a disaster recovery strategy. CX Codex +1 4,700installs pulumi-esc pulumi Guides coding agents through managing environments, secrets, and OIDC credentials in Pulumi ESC. It structures YAML manifests and connects them to Pulumi stacks. CX Codex +1 1,400installs powershell-master JosiahSiegel A skill for PowerShell work: cmdlet syntax, PSGallery modules, CI/CD pipeline patterns and security. Useful whenever the agent writes a .ps1 or edits a pipeline. CX Codex +1 1,100installs aspire-deployment Microsoft A skill that routes Aspire app deployment from the AppHost model to Docker Compose, Kubernetes, Azure, AWS or Radius. Useful when you publish artifacts or tear down resources. CX Codex +1 616installs

From the same set7

ingest-pipelines A skill that guides the agent through building and editing Elasticsearch ingest pipelines: parsing, branching, sub-pipelines, error handling. CX Codex +1 516installs dashboard-review Compares Kibana dashboard JSON changes between branches and checks modified dashboards against Elastic guidelines. Use it when reviewing a dashboard PR. CX Codex +1 510installs anonymize-logs Replaces sensitive values in customer logs line by line, leaving structure and format untouched. Useful when logs go to a vendor or into a commit. CX Codex +1 509installs create-integration This skill creates Elastic integration packages, sets up data streams, and coordinates CEL, pipeline, and system-test work. CX Codex +1 508installs cel-programs A skill for CEL and mito work in API-collecting integrations: cel.yml.hbs templates, manifests, mock-first debugging. CX Codex +1 504installs maintain-integration Reviews and improves existing Elastic integration packages, covering manifests, pipelines, CEL programs, field mappings, and ECS categorization. CX Codex +1 503installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor