Agent skill · elastic
elasticsearch-anomaly-detection
Create and manage Elastic ML anomaly detection jobs via the API. Use when setting up jobs on an index or data stream, configuring jobs and datafeeds, or opening, starting, or stopping them.
What it needs
About 4k tokens when loaded.
What this skill does
Elasticsearch Anomaly Detection Create, open, and start ML anomaly detection jobs on time-series data. Choose the right count-family detector direction, configure bucket span and time field, wire the datafeed to the correct index, and confirm running state from stats — not from assumptions. <!-- begin-partial: preamble --> Environment Configuration This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds. This skill references operations in HTTP-shorthand form (e.g., GET /, GET /cat/indices, GET /{index}/mapping, GET /{index}/settings/index.mode, POST /query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly. <!-- end-partial: preamble --> Prerequisite: ML anomaly detection requires a Platinum-equivalent license on self-managed clusters. Serverless projects include ML. The caller needs manageml to create and manage jobs. Related skill: For interpreting anomaly scores, influencers, and model behavior after a job is running, use elasticsearch-anomaly-detection-explainer — not this skill. Process 1. Discover the target index and time field. List candidate indices with GET /cat/indices (pass a pattern when the user names one). Fetch field types for the chosen index with GET /{index}/mapping. The decision: confirm the index exists, identify the time field (often @timestamp), and verify document volume is sufficient for baseline learning. Never guess index or field names — they vary across deployments. 2. Choose detector function and direction. Match the user's intent to a count-family detector in analysisconfig.detectors: Spike, surge, unusual increase in event volume → highcount (or count, which flags both directions but is acceptable when the user cares about spikes). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/elasticsearch-anomaly-detection--eb460c