# Elasticsearch Esql

Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill elasticsearch-esql -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill elasticsearch-esql -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill elasticsearch-esql -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill elasticsearch-esql -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Elasticsearch ES|QL

Execute ES|QL queries against Elasticsearch: discover the schema, choose the right ES|QL feature for the task, generate
the simplest correct query, and run it.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

## What is ES|QL?

ES|QL (Elasticsearch Query Language) is a piped query language for Elasticsearch. It is **NOT** the same as:

- Elasticsearch Query DSL (JSON-based)
- SQL
- EQL (Event Query Language)

ES|QL uses pipes (`|`) to chain commands:
`FROM index | WHERE condition | STATS aggregation BY field | SORT field | LIMIT n`

The rest: https://github.com/elastic/agent-skills/blob/HEAD/skills/elasticsearch/elasticsearch-esql/SKILL.md