# Elasticsearch Anomaly Detection

Create and manage Elastic ML anomaly detection jobs via the API.

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Data and ML
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Create and manage Elastic ML anomaly detection jobs via the API. Use when setting up jobs on an index or data stream, configuring jobs and datafeeds, or opening, starting, or stopping them.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Elasticsearch Anomaly Detection

Create, open, and start ML anomaly detection jobs on time-series data. Choose the right count-family detector direction,
configure bucket span and time field, wire the datafeed to the correct index, and confirm running state from stats, not
from assumptions.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

> **Prerequisite:** ML anomaly detection requires a Platinum-equivalent license on self-managed clusters. Serverless
> projects include ML. The caller needs `manage_ml` to create and manage jobs.
>
> **Related skill:** For interpreting anomaly scores, influencers, and model behavior after a job is running, use
> `elasticsearch-anomaly-detection-explainer`, not this skill.

## Process

1. **Discover the target index and time field.** List candidate indices with `GET /_cat/indices` (pass a pattern when
   the user names one). Fetch field types for the chosen index with `GET /{index}/_mapping`. The decision: confirm the
   index exists, identify the time field (often `@timestamp`), and verify document volume is sufficient for baseline
   learning. Never guess index or field names, they vary across deployments.

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/elasticsearch/skills/elasticsearch-anomaly-detection/SKILL.md