Agent Builder for Observability
Agent Builder is Elastic's AI platform which includes a natural language chat interface, built-in agents and Elastic tools, and allows creating custom agents and tools for your use case. You can manage and interact with your agents using the Kibana UI or work programmatically.
Agent Builder integrates tightly with Observability, shipping with built-in agents and tools designed for observability use cases, and you can create your own custom agents and tools to fit your specific needs. Combine your agents with Elastic Workflows to automatically isolate hosts, create cases, send notification messages to external platforms, and more.
-
Elastic Agent Builder is the default chat experience in Observability. -
In Elastic Stack version 9.3, you need to opt in to use Agent Builder in Observability.
While Agent Builder works with any configured model, model performance varies. Refer to recommended models to select a model that performs well for your intended use cases.
The Elastic AI Agent includes built-in Observability skills designed to assist with infrastructure monitoring, application performance troubleshooting, and root cause analysis.
By default it includes the observability.investigation skill. You can create a custom skill to extend the agent's capabilities for your specific use case. To learn more about the available skills, refer to Elastic Agent Builder built-in skills reference.
When you chat with the agent from an Observability UI, it uses the current page's time picker as the default time range when invoking tools, unless you specify a different range in your prompt. Outside of a UI context, tools fall back to their built-in defaults.
When you chat with the agent from a Synthetics monitor detail page, it automatically has access to the monitor's configuration via the observability.monitor attachment. This context is available on all monitor detail tabs (Overview, History, Errors, and Alerts), and includes:
- Monitor name, type, and schedule
- Configured locations (public and private)
- Tags
Elastic Agent Builder can start an investigation from the Observability view where you spotted a problem. Use Add to chat in the header of an alert detail page, or Investigate map on the full Service map page. Each action opens a new conversation that already includes the context of what you were viewing, so the agent can begin investigating without you describing the problem first.
Both actions require:
- An Enterprise license on the Elastic Stack, or the Observability Complete feature tier on Elastic Observability Serverless.
- The Agent Builder chat experience.
- An available model through a supported inference endpoint or Generative AI connector, including preconfigured models. Refer to Model configuration.
- Permission to use Agent Builder and read the data you want to investigate.
If an action is missing, check these requirements with your administrator.
When you click Add to chat on an Observability alert detail page, the new conversation includes an observability.alert attachment. The attachment identifies the selected alert so the agent can retrieve its full details, including the rule, status, reason, and related entities, using your permissions.
The conversation automatically starts with Investigate this alert. Follow the steps to start an AI investigation from an alert.
When you click Investigate map on the full Service map page, the new conversation includes a Service map context attachment (observability.service-map-context). It captures these settings from the view:
- Time range
- Selected environment
- KQL query
- Selected service group
- Highlighted services
The attachment contains the view settings, not a snapshot of the map data. The agent retrieves data for the investigation and prioritizes highlighted services.
The service group is included as context but does not restrict the investigation's data queries to that group. The environment and KQL query filter service health information, but the topology can include connections from other environments.
For the entry point and the investigation's findings, refer to Investigate the service map with AI.
Workflows is an automation engine built into the Elastic platform. You can define workflows declaratively in YAML to create deterministic, event-driven automation, without building custom integrations or switching context from your Elastic environment. Combined with Agent Builder, Workflows enable you to:
- Reduce alert fatigue by automating responses to reduce manual triage
- Automate routine tasks
- Eliminate the need for external automation tools
Workflows are tightly integrated with Agent Builder functionalities:
Agents can trigger workflows to take reliable, repeatable actions. For more information, refer to Workflow tools in Elastic Agent Builder.
Workflows can call agents when a step benefits from reasoning, language understanding, or other LLM capabilities. For more information, refer to Steps.
For an end-to-end documented example, refer to Automate root cause analysis for an Observability alert, which invokes an Agent Builder agent on each alert, opens a case populated with the analysis, and supports configurable next-step branches.
For additional examples, including complete annotated code samples, refer to the elastic/workflows/observability GitHub repo.