ELK Log Investigator

This skill teaches an agent how to use the elk-mcp-server MCP tools (https://github.com/UdayHE/elk_mcp-server) to debug production issues from Elastic Cloud logs. All tools are read-only.

The elk MCP server must be configured in the host (see references/setup.md). If the elk_* tools are not available, tell the user to set it up first and stop.

Follow these steps in order. Each step is cheap and tells you whether the next one is needed.

1. elk_overview (always first). Pass the region, a time window in hours, and the namespace if known. It returns counts only: a time histogram and top levels, namespaces and pods. Use it to find when the problem started and which pods or namespaces are affected.
2. elk_error_patterns. Deduplicates repeated errors (UUIDs, hex, IPs and numbers are normalized) into ranked patterns with a sample document id and index. Use it to find what is failing, ranked by frequency.
3. elk_get_log. Fetch one full, untruncated document (message and stack trace) using the id and index from a pattern sample.
4. elk_context. Pull logs just before and after a specific moment for a pod or namespace to see what led up to the failure.
5. elk_search. Use for targeted, field-filtered queries. Output is compact TSV and cursor-paginated. Prefer narrow filters over large windows.
6. elk_dump. Only for bulk analysis. It writes JSONL to a local file so you can grep it without loading results into context.