Observability Logs Search

When you're debugging production incidents in Elastic, this skill gives Claude direct access to your observability logs through ES|QL queries. It follows the same iterative workflow you'd use in Kibana Discover: set a time range, apply filters, then progressively narrow down with NOT clauses until you isolate the interesting stuff. You can view logs in context around a specific event or pivot to search by a different entity. The discipline here is good: it enforces ES|QL only and tells you upfront this is for logs, not metrics or traces. If you're already running the Elastic stack and want Claude to help investigate incidents without switching contexts, this handles the query mechanics so you can focus on the actual problem.