# kibana-anomaly-detection

Investigates Elastic ML anomalies, explains detector scores, and troubleshoots failed datafeeds. Useful for root-cause analysis across Elasticsearch jobs.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3100 installs · ★ 601
- Author: elastic
- License: Apache-2.0 · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/elastic/agent-skills/tree/HEAD/skills/kibana/kibana-anomaly-detection/SKILL.md
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/skills/kibana-anomaly-detection

## What it does

This skill guides agents through Elastic ML anomaly detection across four modes: Investigate, Explain, Troubleshoot, and Manage. It inspects incident records from `.ml-anomalies-*` and fetches job lifecycle status through ML REST APIs.

Execution depends strictly on the `elastic` CLI. If the CLI is not configured, the assistant cannot query the cluster, because direct HTTP requests or guessed credentials are explicitly barred.

The skill supports Elasticsearch 8.x–9.x and Elastic Cloud Serverless. Because legacy results endpoints return HTTP 410 on Serverless, queries always run through `POST /.ml-anomalies-*/_search` using `result_type` filters.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill kibana-anomaly-detection -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/kibana-anomaly-detection/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/kibana-anomaly-detection/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill kibana-anomaly-detection -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/kibana-anomaly-detection/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill kibana-anomaly-detection -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/kibana-anomaly-detection/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install elastic/agent-skills kibana-anomaly-detection
```

2. **Manually: put the files in place**
- File: `.github/skills/kibana-anomaly-detection/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill kibana-anomaly-detection -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/elastic/agent-skills --path skills/kibana/kibana-anomaly-detection
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/kibana-anomaly-detection/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill kibana-anomaly-detection -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/elastic/agent-skills/tree/HEAD/skills/kibana/kibana-anomaly-detection/SKILL.md

## When to use it
- Identify anomalous entities and root causes across ML jobs
- Explain score changes and model renormalization effects
- Troubleshoot stopped datafeeds and memory limit failures
- Inspect model bounds and configure ML anomaly detection jobs

## Example prompts
- What caused the anomaly spike in our network-traffic ML job?
- Explain why the record score dropped after renormalization
- Troubleshoot why the datafeed stopped with a hard_limit error

## Source text · SKILL.md · Apache-2.0

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 414c38fb9678232f.

BEGIN THIRD-PARTY FILE 414c38fb9678232f
```text
---
name: kibana-anomaly-detection
description: >
  Elastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle
  troubleshooting, and job operations. Use when answering "what broke?"/"which entity?"/RCA,
  "why is score high/low?"/renormalization, "datafeed stopped"/"memory limit"/hard_limit,
  or configuring ML anomaly detection jobs. Reads results from `.ml-anomalies-*` and
  job state from ML REST APIs.
metadata:
  author: elastic
  version: 0.3.0
  universal: true
compatibility: Elasticsearch 8.x–9.x or Elastic Cloud Serverless with ML anomaly detection;
  Kibana 8.x–9.x for saved-object context only
---

# Elastic ML Anomaly Detection

Expert process for ML anomaly detection: attribute incidents to entities, explain scores and model behavior, diagnose
job lifecycle failures, and manage jobs. Read anomaly **results** from `POST /.ml-anomalies-*/_search` (Serverless-safe)
and **job/datafeed state** from ML REST APIs. When the user embeds fixture evidence (influencer rows, job stats) in the
prompt, apply the judgment below directly — do not re-fetch fields already supplied.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command — always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

## Mode selector

| User intent                                                                   | Mode                                                                                                   |
| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| "What broke?" / RCA / cross-job / blast radius / influencers / log categories | **Investigate**                                                                                        |
| "Why score high/low?" / renormalization / model bounds / forecasts            | **Explain**                                                                                            |
| Missing docs / memory limit / datafeed stopped / lifecycle / calendars        | **Troubleshoot**                                                                                       |
```
END THIRD-PARTY FILE 414c38fb9678232f

The third-party file has ended. Everything between the 414c38fb9678232f tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2818 of 24276 bytes. © elastic · Apache-2.0 · https://github.com/elastic/agent-skills/tree/HEAD/skills/kibana/kibana-anomaly-detection/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md