1. Habit
  2. Skills
  3. Elasticsearch ES|QL skill
elastic · 5K installs

Elasticsearch ES|QL skill
Runs by itself, daily log digest.

Daily log patterns and spikes reported.

Install the Elasticsearch ES|QL skill and make it a habit: follow https://gethabit.dev/skills/elastic/elasticsearch-esql.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

5K installs597 starsApache-2.0 licenceSource on GitHub ↗

Elasticsearch ES|QL

by elastic · 5K installs

The skill

Elasticsearch ES|QL runs queries through the elastic CLI: it checks the cluster, discovers the schema, picks the right ES|QL feature and runs the simplest correct query for logs, metrics, search or time series.

Only when you ask.

The habit

Daily log patterns and spikes reported.

↻ Runs by itselfdaily log digest

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

daily log digest. Runs in Claude Code routine.

  • ↻ daily log digest
  • 0 7 * * *

02

It checks its work

connection + query runs. If a check fails, it tells you.

  • ✓elastic es info returns a build_flavor
  • ✓every query ran without an Elasticsearch error
  • ✓every exploratory query ends with LIMIT

03

It remembers

query and digest log. The next run reads it first: index names, field names and working queries from earlier runs.

loops/esql-log-digest-loop/log.md

One run, step by step.
Then it stops.

Stop ruleStops after at most 5 queries per run, with 2 fixes per failing query.

  1. 01

    Check the cluster

    Run elastic es info and use build_flavor and version to decide which features are available.

  2. 02

    Discover the schema

    List indices with elastic es cat indices and read the mapping, never guessing names.

  3. 03

    Pick features

    Use STATS for counts, CATEGORIZE for patterns and CHANGE_POINT for spikes where the license allows.

  4. 04

    Run queries

    Run each query with elastic es esql query --format tsv and fix errors from the message.

  5. 05

    Write the digest

    Summarize error counts, top patterns and detected change points and log the queries.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the Elasticsearch ES|QL skill helps.

Use it when

  • ✓ You analyze logs in Elasticsearch
  • ✓ You aggregate metrics over time
  • ✓ You look for spikes or patterns

Skip it when

  • – You need Query DSL JSON
  • – Your cluster is older than 8.11

Questions

Elasticsearch ES|QL skill, answered.

Does it call the HTTP API directly?

No. The skill always uses the elastic CLI and never guesses credentials.

Can I use CATEGORIZE and CHANGE_POINT on any cluster?

The skill marks both as Platinum license features.

Is ES|QL the same as SQL or Query DSL?

No. It is a separate piped query language.

How do I install the Elasticsearch ES|QL skill?

Copy the prompt at the top into your agent. It installs the skill from elastic/agent-skills and sets up the habit. Or run npx skills add elastic/agent-skills --skill elasticsearch-esql.

Is the Elasticsearch ES|QL skill free?

Yes. It is published under Apache-2.0. Habit is free too.

Elasticsearch ES|QL. Now as a habit.

Install the Elasticsearch ES|QL skill and make it a habit: follow https://gethabit.dev/skills/elastic/elasticsearch-esql.md

  • Free
  • No account
  • Undo in one line

All elastic skills →More ops skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by elastic, published under Apache-2.0. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.