Limitations and known issues in Elastic Agent Builder
This section lists the limitations and known issues in Elastic Agent Builder.
- Elastic Stack users: an Enterprise subscription.
- Elastic Security Serverless users: the Security Analytics Complete or Elastic AI Soc Engine (EASE) feature tier.
- Elastic Observability Serverless and Elasticsearch Serverless users: the Complete feature tier.
Refer to Get started if you need instructions about enabling Elastic Agent Builder for your deployment type.
The A2A server does not currently support streaming operations. All agent interactions use the synchronous message/send method, which returns a complete response only after task execution completes.
ES|QL tools are subject to the current limitations of the ES|QL language.
Ensure your cluster version supports the ES|QL features you intend to use.
For a complete list of ES|QL limitations, refer to the ES|QL limitations documentation.
The following errors suggest your selected model may not be compatible with Elastic Agent Builder:
Error: Invalid function call syntax
Error executing agent: No tool calls found in the response.
To learn more, refer to Using different models in Elastic Agent Builder.
This error occurs when a conversation exceeds the maximum context length supported by the LLM. This typically happens when tools return large responses that consume the available token budget.
To learn more, refer to Context length exceeded in Elastic Agent Builder conversations.
The .execute_esql tool is designed only for ES|QL syntax, not other query languages.
When using SQL syntax with the default agent, it attempts to use the .execute_esql tool instead of recognizing the input as SQL.
This results in parsing errors like this:
[
{
"type": "error",
"data": {
"message": "parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}",
"stack": "ResponseError: parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}\n at KibanaTransport._request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:591:17)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:697:22\n at KibanaTransport.request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:694:14)"
}
}
]
Fixed on serverless and 9.3.
On 9.2 deployments, the Copy your MCP server URL button does not include the space name when used from a custom Kibana Space.
Workaround: Manually add /s/<space-name> to the URL. For example: https://<deployment>/s/<space-name>/api/agent_builder/mcp
For more information about Elastic Agent Builder and Spaces, refer to Permissions and access control.