# Kibana Context Engine

Query Elastic Context Engine AI Indices, and the Knowledge Indicators (KIs) they store.

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Writing
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill kibana-context-engine -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill kibana-context-engine -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill kibana-context-engine -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill kibana-context-engine -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Query Elastic Context Engine AI Indices, and the Knowledge Indicators (KIs) they store. Use when asked to search, explore, count, or answer questions from an AI Index / KI / Context Engine knowledge index, and when writing the ES|QL that queries one.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Query Context Engine AI Indices

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

## Concepts

**AI Index**, an Elasticsearch index named `ai-index-idx-*`, or a data stream named `ai-index-ds-*`, registered with
the Context Engine under a logical id. The registration lives in Kibana; the knowledge lives in the backing index. Only
the list operation knows which `ai-index-*` indices are registered and what to put in `FROM`; the index name alone does
not tell you.

**Knowledge Indicator (KI)**, one document in an AI Index: context prepared for agents, such as a description of some
data, a summary, an access pattern, a runnable query, or a record of a Kibana resource. A KI may answer a question
outright, or help you locate and use the source that does.

A KI is retired by a tombstone (`governance.lifecycle.status: deleted`) or by an `expires_at` in the past. On a data
stream, one KI is several revisions under the same `id`, the newest of which is its current state. The query API returns
only current, active, unexpired KIs unless the query asks otherwise (see [Lifecycle](#lifecycle)).

Search the AI Indices before broader retrieval whenever their KIs may cover the question. This skill reads KIs;
generating them belongs to the Context Engine's automations and feedback loop.

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/kibana/skills/kibana-context-engine/SKILL.md