# Observability Csp Investigation

Investigate cloud-provider (CSP) service issues, AWS today (the reasoning applies to...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Data and ML
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill observability-csp-investigation -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill observability-csp-investigation -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill observability-csp-investigation -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill observability-csp-investigation -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Investigate cloud-provider (CSP) service issues, AWS today (the reasoning applies to any AWS service; schema and failure signatures are deepest for RDS, Lambda, SQS, ALB, EC2), and in future GCP and Azure, using OTel-schema cloud metrics in Elastic. Use when diagnosing cloud-resource problems, whether alert-triggered or ad hoc: database connection/CPU/memory pressure, function error rates and throttling, queue backlog and consumer lag, load-balancer 5xx, instance saturation. Correlates the resource under investigation against its own baseline, classifies the failure mode, and rules out co-occurring but unrelated conditions.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cloud Provider (CSP) Investigation

Diagnose cloud-provider service issues from OTel-schema metrics and logs in Elastic. The guidelines, flow, and synthesis
below are provider-agnostic and apply to every investigation. The per-provider **reference** carries the schema facts
and failure-mode signatures that cannot be guessed, read it first.

This is the CSP **domain layer**: which index holds a resource's telemetry, what shape its metrics take, and how to read
them into a diagnosis. It assumes the harness can already author ES|QL, it does not teach query syntax, null handling,
or function usage. Keep that split: this skill tells you _what_ to query and _how to interpret_ it; writing the query
itself is the harness's job.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

### Analysis without cluster access

The CLI check above gates _querying the cluster_, it does not gate analysis. When the user has already supplied the
evidence in their question (metric values, alert payloads, log lines, dimension names), reason from that evidence and
deliver the conclusion.

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/observability/skills/csp-investigation/SKILL.md