cloud-manage-project by elastic/agent-skills
npx skills add https://github.com/elastic/agent-skills --skill cloud-manage-project使用 Serverless REST API 对 Elastic Cloud Serverless 项目执行日常运维操作。
EC_API_KEY。如果未配置,请先运行 cloud-setup 技能。403 Forbidden),请停止并让用户验证所提供的 API 密钥权限。cloud-setup 不可用时)如果此技能是独立安装且 cloud-setup 不可用,请指导用户在运行命令前手动配置 Cloud 环境变量。切勿要求用户在聊天中粘贴 API 密钥。
| 变量 | 必需 | 描述 |
|---|---|---|
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
EC_API_KEY| 是 |
| 用于项目管理操作的 Elastic Cloud API 密钥。 |
EC_BASE_URL | 否 | Cloud API 基础 URL(默认:https://api.elastic-cloud.com)。 |
注意: 如果缺少
EC_API_KEY,或者用户尚未拥有 Cloud API 密钥,请指导用户前往 Elastic Cloud API 密钥 生成一个,然后使用以下步骤在本地进行配置。
首选方法(代理友好):在项目根目录创建 .env 文件:
EC_API_KEY=your-api-key
EC_BASE_URL=https://api.elastic-cloud.com
所有 cloud/* 脚本都会自动从工作目录加载 .env。
替代方法:直接在终端中导出:
export EC_API_KEY="<your-cloud-api-key>"
export EC_BASE_URL="https://api.elastic-cloud.com"
终端导出的变量对于在独立 shell 会话中运行的沙盒化代理可能不可见,因此在使用代理时优先选择 .env 文件。
.elastic-credentials 文件。管理员密码绝不能出现在聊天历史记录、思考痕迹或代理输出中——即使在使用它创建 API 密钥时,也应通过 shell 变量替换直接传递,而不回显。.elastic-credentials。密码在标准输出中被隐藏。切勿在聊天中读取或显示 .elastic-credentials 的内容。create-project 和 reset-credentials 保存的 admin 密码仅用于引导创建作用域受限的 API 密钥——切勿将其用于直接的 Elasticsearch 操作。load-credentials 默认排除管理员凭据;仅在创建密钥时传递 --include-admin。ELASTICSEARCH_API_KEY 之前,不要继续进行 Elasticsearch 操作。如果只有管理员凭据可用,请通过 elasticsearch-authn 创建一个作用域受限的 API 密钥。如果该技能未安装,请要求用户安装它或在 Kibana > 堆栈管理 > API 密钥 中手动创建密钥。--type 和 --id(list 除外,它只需要 --type)。EC_API_KEY) 进行项目管理操作(列表、获取、更新、删除)。Elasticsearch 操作需要单独的 Elasticsearch API 密钥 (ELASTICSEARCH_API_KEY),该密钥针对项目的 Elasticsearch 端点进行身份验证。请勿混淆两者。当用户要求查询或管理代理在当前会话中未创建的项目时,使用此工作流。它会解析项目,保存其端点,并在继续之前确保 Elasticsearch 凭据有效。
此工作流仅适用于 Elastic Cloud Serverless 项目。如果用户的 Elasticsearch 实例是自管理的或 Elastic Cloud Hosted,此技能不适用——请跳过它并直接使用相关技能。如果不确定,请询问用户:"您的 Elasticsearch 实例是 Elastic Cloud Serverless 项目吗?"
连接到现有项目:
- [ ] 步骤 1:解析项目
- [ ] 步骤 2:获取项目详情并加载凭据
- [ ] 步骤 3:获取 Elasticsearch 凭据
如果尚未提供,请向用户询问项目名称。根据用户的请求推断项目类型:
| 用户提及 | --type |
|---|---|
| "search project"、"elasticsearch project"、向量搜索 | elasticsearch |
| "observability project"、"o11y"、日志、指标、追踪、APM | observability |
| "security project"、"SIEM"、检测、端点保护 | security |
如果类型不明确,请列出所有三种类型以查找项目。
python3 skills/cloud/manage-project/scripts/manage-project.py list \
--type elasticsearch
将用户的引用(名称、部分名称或别名)与列表结果进行匹配。如果多个项目匹配或没有匹配项,请呈现候选项目并让用户选择。
一旦确定单个项目,检查 .elastic-credentials 是否已包含此项目的条目(来自之前的会话)。如果有,使用 load-credentials 加载它们:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
此命令会为项目设置所有保存的环境变量——端点和任何先前创建的 Elasticsearch API 密钥——在一个命令中完成。管理员凭据 (ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD) 被有意排除。同一项目的后续部分会自动覆盖较早的值,因此最新的凭据始终生效。
如果 load-credentials 报告没有匹配的条目,则从 API 获取项目详情并手动导出端点:
python3 skills/cloud/manage-project/scripts/manage-project.py get \
--type elasticsearch \
--id <project-id>
然后从响应中导出端点 URL。可用的端点取决于项目类型。
所有项目类型:
export ELASTICSEARCH_URL="<elasticsearch_endpoint>"
export KIBANA_URL="<kibana_endpoint>"
可观测性项目(附加):
export APM_URL="<apm_endpoint>"
export INGEST_URL="<ingest_endpoint>"
安全项目(附加):
export INGEST_URL="<ingest_endpoint>"
如果 load-credentials 设置了 ELASTICSEARCH_API_KEY,请验证凭据是否有效:
curl -H "Authorization: ApiKey ${ELASTICSEARCH_API_KEY}" \
"${ELASTICSEARCH_URL}/_security/_authenticate"
在继续之前,确认响应包含有效的 username 和 "authentication_type": "api_key"。如果验证成功,请跳过此步骤的其余部分。
如果未加载任何凭据,或验证失败,请询问用户:"您是否有此项目的现有 Elasticsearch API 密钥?"
如果有——让用户将其添加到 .elastic-credentials(参见"凭据文件格式")。不要在聊天中接受密钥。重新加载并验证:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
curl -H "Authorization: ApiKey ${ELASTICSEARCH_API_KEY}" \
"${ELASTICSEARCH_URL}/_security/_authenticate"
如果没有——遵循此恢复路径:
与用户确认,然后重置管理员引导凭据:
python3 skills/cloud/manage-project/scripts/manage-project.py reset-credentials \
--type elasticsearch \
--id <project-id>
新密码将保存到 .elastic-credentials,并在文件头中包含项目名称。请指导用户查看该文件——不要显示其内容。
加载凭据并带上 --include-admin,以便管理员密码可用于创建 API 密钥:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>" --include-admin)
如果可用,使用管理员凭据通过 elasticsearch-authn 创建一个作用域受限的 Elasticsearch API 密钥。如果该技能未安装,请要求用户安装它或在 Kibana > 堆栈管理 > API 密钥 中手动创建密钥。将密钥的作用域限制为用户仅需要的权限。
创建 API 密钥后,使用项目特定的文件头格式将其保存到 .elastic-credentials(参见下面的"凭据文件格式")。然后重新加载不带 --include-admin 以从环境中移除管理员凭据并进行验证:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
curl -H "Authorization: ApiKey ${ELASTICSEARCH_API_KEY}" \
"${ELASTICSEARCH_URL}/_security/_authenticate"
在继续之前,确认响应显示有效的 username 和 "authentication_type": "api_key"。
完整格式规范请参阅 references/credential-file-format.md。
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
或通过项目 ID:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--id <project-id>)
解析 .elastic-credentials,合并匹配项目的所有部分,并打印 export 语句。管理员凭据 (ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD) 默认被排除——仅导出端点和 API 密钥。当您需要管理员凭据来创建 API 密钥时,添加 --include-admin。
python3 skills/cloud/manage-project/scripts/manage-project.py list \
--type elasticsearch
使用 --type observability 或 --type security 列出其他类型的项目。
python3 skills/cloud/manage-project/scripts/manage-project.py get \
--type elasticsearch \
--id <project-id>
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id <project-id> \
--name "new-project-name"
仅更新提供的字段(PATCH 语义)。支持的字段:--name、--alias、--tag、--search-power、--boost-window、--max-retention-days、--default-retention-days。
别名是一个 RFC-1035 域标签(小写字母数字和连字符,最多 50 个字符),将成为项目端点 URL 的一部分。更改别名会更改所有端点 URL,这会破坏指向旧 URL 的现有客户端。在应用之前警告用户这一点。
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id <project-id> \
--alias "prod-search"
标签是用于团队跟踪、成本归因和组织的键值对元数据。为每个标签传递 --tag KEY:VALUE。可以在一次更新中设置多个标签。
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id <project-id> \
--tag env:prod \
--tag team:search
标签在 API 请求中作为 metadata.tags 发送。设置标签会替换项目上所有现有的标签——请包含用户希望保留的任何现有标签。
对于 Elasticsearch 项目,有两个字段控制 Search AI Lake 中的查询性能和数据缓存。摄取的数据存储在成本效益高的通用存储中。其上的缓存层为最近和频繁查询的数据提供更快的搜索速度——这些缓存数据被视为可搜索就绪。
| 标志 | 范围 | 描述 |
|---|---|---|
--search-power | 28–3000 | 查询性能级别。值越高性能越好,但成本也越高 |
--boost-window | 1–180 | 有资格进行增强缓存的数据天数(默认:7) |
搜索能力通过调配更多或更少的查询资源来控制搜索速度。常见预设值(与 Cloud UI 匹配):
| 值 | 预设 | 行为 |
|---|---|---|
| 28 | 按需 | 自动扩展,基线较低。延迟变化较大,最大吞吐量降低 |
| 100 | 高性能 | 持续低延迟,为中等高吞吐量自动扩展 |
| 250 | 高可用性 | 针对高吞吐量场景优化,在高负载下保持低延迟 |
当用户按名称请求预设时,将其映射到相应的值。28–3000 范围内的自定义值也有效。
在更新 search_power 之前警告用户成本影响。 更高的值会增加 VCU 消耗,并可能导致更高的账单。在应用之前与用户确认新值。
非时间序列数据始终是可搜索就绪的。增强窗口决定了有多少时间序列数据(具有 @timestamp 字段的文档)也保留在快速缓存层中。增加窗口意味着更大部分的时间序列数据变得可搜索就绪,这提高了对近期数据的查询速度,但增加了可搜索就绪的数据量。
对于安全项目,有两个字段控制数据在 Search AI Lake 中的保留时间。保留是按数据流配置的,但这些项目级设置强制执行全局边界。
| 标志 | 单位 | 描述 |
|---|---|---|
--max-retention-days | 天 | 项目中任何数据流的最大保留期限 |
--default-retention-days | 天 | 应用于没有自定义保留期的数据流的默认保留期 |
在减少 max-retention-days 之前警告用户。 降低最大值会永久删除超过新限制的数据。在应用之前与用户确认新值。
重置前务必与用户确认。
python3 skills/cloud/manage-project/scripts/manage-project.py reset-credentials \
--type elasticsearch \
--id <project-id>
新密码会自动保存到 .elastic-credentials。告诉用户打开该文件——不要在聊天中显示其内容。
删除前务必与用户确认。
python3 skills/cloud/manage-project/scripts/manage-project.py delete \
--type elasticsearch \
--id <project-id>
项目在试用期结束后可能会自动暂停。使用以下命令恢复:
python3 skills/cloud/manage-project/scripts/manage-project.py resume \
--type elasticsearch \
--id <project-id>
恢复后,轮询项目状态,直到阶段从 initializing 更改为 initialized。
python3 skills/cloud/manage-project/scripts/manage-project.py list --type security
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id abc123def456abc123def456abc12345 \
--search-power 500
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type security \
--id abc123def456abc123def456abc12345 \
--max-retention-days 396 \
--default-retention-days 396
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id abc123def456abc123def456abc12345 \
--alias "prod-search"
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type observability \
--id abc123def456abc123def456abc12345 \
--tag env:prod \
--tag team:platform
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type observability \
--id abc123def456abc123def456abc12345 \
--name "production-logs"
用户:我想对我的搜索项目 "prod-search" 运行查询
代理:让我找到那个项目。
[运行:list --type elasticsearch]
我找到了 "prod-search"(ID:abc123...)。正在加载保存的凭据...
[运行:eval $(load-credentials --name prod-search)]
凭据已加载。正在验证...
[运行:curl -H "Authorization: ApiKey ..." "${ELASTICSEARCH_URL}/_security/_authenticate"]
已验证——通过 API 密钥认证为用户 "my-service"。一切就绪。
用户:让我们将一些日志摄取到我的 o11y 项目 "siem-prod" 中
代理:让我找到那个项目。
[运行:list --type observability]
找到了 "siem-prod"(ID:def456...)。未找到此项目的保存凭据。
[运行:get --type observability --id def456...]
端点已设置。由于文件中没有 Elasticsearch 凭据,我可以重置管理员引导密码以获得初始访问权限。是否继续?
用户:是的
代理:[运行:reset-credentials --type observability --id def456...]
凭据已保存到 .elastic-credentials——打开该文件以获取密码。
[运行:eval $(load-credentials --name siem-prod --include-admin)]
管理员凭据已加载,用于创建 API 密钥。现在创建一个作用域受限的 Elasticsearch API 密钥——它需要什么访问权限?
用户:对 logs-* 的只读权限
代理:[使用管理员凭据通过 elasticsearch-authn 创建作用域受限的 API 密钥]
[将 API 密钥附加到 .elastic-credentials,并带有项目头]
[运行:eval $(load-credentials --name siem-prod)]
[针对 ELASTICSEARCH_URL 进行验证]
API 密钥已创建并验证。管理员凭据已从环境中移除。
用户:删除我的 elasticsearch 项目 abc123...
代理:您确定要删除项目 abc123... 吗?此操作无法撤销。
用户:是的
python3 skills/cloud/manage-project/scripts/manage-project.py delete \
--type elasticsearch \
--id abc123def456abc123def456abc12345
EC_API_KEY 未设置,请先运行 cloud-setup 技能。cloud-create-project 技能创建新项目——此技能仅处理现有项目。search_power 之前警告成本影响。首先与用户确认新值。max-retention-days 之前警告数据丢失风险。超过新最大值的数据将被永久删除。get 检索当前标签,并包含用户希望保留的任何标签。| 命令 | 描述 |
|---|---|
list | 按类型列出项目 |
get | 按 ID 获取项目详情 |
update | 更新项目名称、别名、标签或 search_lake 设置 |
reset-credentials | 重置项目凭据(新密码) |
delete | 删除项目 |
resume | 恢复已暂停的项目 |
load-credentials | 从 .elastic-credentials 加载项目的保存凭据 |
| 标志 | 命令 |
| --- | --- |
--type | list, get, update, reset-credentials, delete, resume |
--id | get, update, reset-credentials, delete, resume, load-credentials |
--name | update, load-credentials |
--alias | update |
--tag | update |
--search-power | update |
--boost-window | update |
--max-retention-days | update |
--default-retention-days | update |
--include-admin | load-credentials |
--wait-seconds | reset-credentials |
| 变量 | 必需 | 描述 |
|---|---|---|
EC_API_KEY | 是 | Elastic Cloud API 密钥(项目管理操作) |
EC_BASE_URL | 否 | Cloud API 基础 URL(默认:https://api.elastic-cloud.com) |
ELASTICSEARCH_URL | 输出 | Elasticsearch URL(解析项目后为下游技能设置) |
KIBANA_URL | 输出 | Kibana URL(解析项目后为下游技能设置) |
APM_URL | 输出 | APM 端点(仅限可观测性项目) |
INGEST_URL | 输出 | OTLP 摄取端点(可观测性和安全项目) |
ELASTICSEARCH_API_KEY | 输出 | Elasticsearch API 密钥(用于堆栈级操作) |
每周安装次数
140
代码仓库
GitHub 星标数
136
首次出现
12 天前
安全审计
安装于
cursor126
github-copilot118
opencode117
gemini-cli117
codex117
amp117
Perform day-2 operations on Elastic Cloud Serverless projects using the Serverless REST API.
EC_API_KEY is configured. If not, run cloud-setup skill first.403 Forbidden), stop and ask the user to verify the provided API key permissions.cloud-setup is unavailable)If this skill is installed standalone and cloud-setup is not available, instruct the user to configure Cloud environment variables manually before running commands. Never ask the user to paste API keys in chat.
| Variable | Required | Description |
|---|---|---|
EC_API_KEY | Yes | Elastic Cloud API key used for project management operations. |
EC_BASE_URL | No | Cloud API base URL (default: https://api.elastic-cloud.com). |
Note: If
EC_API_KEYis missing, or the user does not have a Cloud API key yet, direct the user to generate one at Elastic Cloud API keys, then configure it locally using the steps below.
Preferred method (agent-friendly): create a .env file in the project root:
EC_API_KEY=your-api-key
EC_BASE_URL=https://api.elastic-cloud.com
All cloud/* scripts auto-load .env from the working directory.
Alternative: export directly in the terminal:
export EC_API_KEY="<your-cloud-api-key>"
export EC_BASE_URL="https://api.elastic-cloud.com"
Terminal exports may not be visible to sandboxed agents running in separate shell sessions, so prefer .env when using an agent.
.elastic-credentials file instead. The admin password must never appear in chat history, thinking traces, or agent output — even when using it to create an API key, pass it directly via shell variable substitution without echoing..elastic-credentials automatically. The password is redacted from stdout. Never read or display the contents of .elastic-credentials in chat.admin password saved by create-project and reset-credentials exists solely to bootstrap a scoped API key — never use it for direct Elasticsearch operations. load-credentials excludes admin credentials by default; pass only for key creation.Use this workflow when the user asks to query or manage a project the agent did not create in the current session. It resolves the project, saves its endpoints, and ensures working Elasticsearch credentials before proceeding.
This workflow only applies to Elastic Cloud Serverless projects. If the user's Elasticsearch instance is self-managed or Elastic Cloud Hosted, this skill does not apply — skip it and proceed with the relevant skill directly. If unsure, ask the user: "Is your Elasticsearch instance an Elastic Cloud Serverless project?"
Connect to Existing Project:
- [ ] Step 1: Resolve the project
- [ ] Step 2: Get project details and load credentials
- [ ] Step 3: Acquire Elasticsearch credentials
Ask the user for the project name if not already provided. Infer the project type from the user's request:
| User says | --type |
|---|---|
| "search project", "elasticsearch project", vector search | elasticsearch |
| "observability project", "o11y", logs, metrics, traces, APM | observability |
| "security project", "SIEM", detections, endpoint protection | security |
If the type is ambiguous, list all three types to find the project.
python3 skills/cloud/manage-project/scripts/manage-project.py list \
--type elasticsearch
Match the user's reference (name, partial name, or alias) against the list results. If multiple projects match or none match, present the candidates and ask the user to pick.
Once a single project is identified, check whether .elastic-credentials already has entries for this project (from a previous session). If so, load them with load-credentials:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
This sets all saved environment variables for the project — endpoints and any previously created Elasticsearch API keys — in a single command. Admin credentials (ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD) are intentionally excluded. Later sections for the same project automatically overwrite earlier values, so the most recent credentials always win.
If load-credentials reports no matching entries, fetch the project details from the API and export endpoints manually:
python3 skills/cloud/manage-project/scripts/manage-project.py get \
--type elasticsearch \
--id <project-id>
Then export the endpoint URLs from the response. The available endpoints depend on the project type.
All project types:
export ELASTICSEARCH_URL="<elasticsearch_endpoint>"
export KIBANA_URL="<kibana_endpoint>"
Observability projects (additional):
export APM_URL="<apm_endpoint>"
export INGEST_URL="<ingest_endpoint>"
Security projects (additional):
export INGEST_URL="<ingest_endpoint>"
If load-credentials set ELASTICSEARCH_API_KEY, verify the credentials work:
curl -H "Authorization: ApiKey ${ELASTICSEARCH_API_KEY}" \
"${ELASTICSEARCH_URL}/_security/_authenticate"
Confirm the response contains a valid username and "authentication_type": "api_key" before proceeding. If verification succeeds, skip the rest of this step.
If no credentials were loaded, or verification fails, ask the user: "Do you have an existing Elasticsearch API key for this project?"
If yes — have the user add it to .elastic-credentials (see "Credential file format"). Do not accept keys in chat. Reload and verify:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
curl -H "Authorization: ApiKey ${ELASTICSEARCH_API_KEY}" \
"${ELASTICSEARCH_URL}/_security/_authenticate"
If no — follow this recovery path:
Confirm with the user, then reset the admin bootstrap credentials:
python3 skills/cloud/manage-project/scripts/manage-project.py reset-credentials \
--type elasticsearch \
--id <project-id>
The new password is saved to .elastic-credentials with the project name in the header. Direct the user to that file — do not display its contents.
Load credentials with--include-admin so the admin password is available for API key creation:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>" --include-admin)
Use the admin credentials to create a scoped Elasticsearch API key via elasticsearch-authn if available. If that skill is not installed, ask the user to install it or create the key manually in Kibana > Stack Management > API keys. Scope the key to only the privileges the user needs.
After creating the API key, save it to .elastic-credentials using the project-specific header format (see "Credential file format" below). Then reload without--include-admin to drop admin credentials from the environment and verify:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
curl -H "Authorization: ApiKey ${ELASTICSEARCH_API_KEY}" \
"${ELASTICSEARCH_URL}/_security/_authenticate"
Confirm the response shows a valid username and "authentication_type": "api_key" before proceeding.
See references/credential-file-format.md for the full format specification.
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--name "<project-name>")
Or by project ID:
eval $(python3 skills/cloud/manage-project/scripts/manage-project.py load-credentials \
--id <project-id>)
Parses .elastic-credentials, merges all sections for the matching project, and prints export statements. Admin credentials (ELASTICSEARCH_USERNAME/ELASTICSEARCH_PASSWORD) are excluded by default — only endpoints and API keys are exported. Add --include-admin when you need admin credentials to create an API key.
python3 skills/cloud/manage-project/scripts/manage-project.py list \
--type elasticsearch
Use --type observability or --type security to list other project types.
python3 skills/cloud/manage-project/scripts/manage-project.py get \
--type elasticsearch \
--id <project-id>
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id <project-id> \
--name "new-project-name"
Only the fields provided are updated (PATCH semantics). Supported fields: --name, --alias, --tag, --search-power, --boost-window, --max-retention-days, --default-retention-days.
The alias is an RFC-1035 domain label (lowercase alphanumeric and hyphens, max 50 chars) that becomes part of the project's endpoint URLs. Changing the alias changes all endpoint URLs , which breaks existing clients pointing to the old URLs. Warn the user about this before applying.
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id <project-id> \
--alias "prod-search"
Tags are key-value metadata pairs for team tracking, cost attribution, and organization. Pass --tag KEY:VALUE for each tag. Multiple tags can be set in a single update.
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id <project-id> \
--tag env:prod \
--tag team:search
Tags are sent as metadata.tags in the API request. Setting tags replaces all existing tags on the project — include any existing tags the user wants to keep.
For Elasticsearch projects, two fields control query performance and data caching in the Search AI Lake. Ingested data is stored in cost-efficient general storage. A cache layer on top provides faster search speed for recent and frequently queried data — this cached data is considered search-ready.
| Flag | Range | Description |
|---|---|---|
--search-power | 28–3000 | Query performance level. Higher values improve performance but increase cost |
--boost-window | 1–180 | Days of data eligible for boosted caching (default: 7) |
Search Power controls the speed of searches by provisioning more or fewer query resources. Common presets (matching the Cloud UI):
| Value | Preset | Behavior |
|---|---|---|
| 28 | On-demand | Autoscales with lower baseline. More variable latency, reduced max throughput |
| 100 | Performant | Consistently low latency, autoscales for moderately high throughput |
| 250 | High availability | Optimized for high-throughput scenarios, maintains low latency at high volumes |
When the user asks for a preset by name, map it to the corresponding value. Custom values within 28–3000 are also valid.
Warn the user about cost implications before updatingsearch_power. Higher values increase VCU consumption and may result in higher bills. Confirm the new value with the user before applying.
Non-time-series data is always search-ready. The boost window determines how much time-series data (documents with a @timestamp field) is also kept in the fast cache layer. Increasing the window means a larger portion of time-series data becomes search-ready, which improves query speed for recent data but increases the search-ready data volume.
For security projects, two fields control how long data is retained in the Search AI Lake. Retention is configured per data stream, but these project-level settings enforce global boundaries.
| Flag | Unit | Description |
|---|---|---|
--max-retention-days | days | Maximum retention period for any data stream in the project |
--default-retention-days | days | Default retention applied to data streams without a custom one |
Warn the user before reducingmax-retention-days. Lowering the maximum permanently deletes data older than the new limit. Confirm the new value with the user before applying.
Always confirm with the user before resetting.
python3 skills/cloud/manage-project/scripts/manage-project.py reset-credentials \
--type elasticsearch \
--id <project-id>
The new password is saved to .elastic-credentials automatically. Tell the user to open that file — do not display its contents in chat.
Always confirm with the user before deleting.
python3 skills/cloud/manage-project/scripts/manage-project.py delete \
--type elasticsearch \
--id <project-id>
Projects can be automatically suspended after their trial period expires. Resume with:
python3 skills/cloud/manage-project/scripts/manage-project.py resume \
--type elasticsearch \
--id <project-id>
After resuming, poll the project status until the phase changes from initializing to initialized.
python3 skills/cloud/manage-project/scripts/manage-project.py list --type security
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id abc123def456abc123def456abc12345 \
--search-power 500
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type security \
--id abc123def456abc123def456abc12345 \
--max-retention-days 396 \
--default-retention-days 396
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type elasticsearch \
--id abc123def456abc123def456abc12345 \
--alias "prod-search"
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type observability \
--id abc123def456abc123def456abc12345 \
--tag env:prod \
--tag team:platform
python3 skills/cloud/manage-project/scripts/manage-project.py update \
--type observability \
--id abc123def456abc123def456abc12345 \
--name "production-logs"
User: I want to run a query against my search project "prod-search"
Agent: Let me find that project.
[runs: list --type elasticsearch]
I found "prod-search" (ID: abc123...). Loading saved credentials...
[runs: eval $(load-credentials --name prod-search)]
Credentials loaded. Verifying...
[runs: curl -H "Authorization: ApiKey ..." "${ELASTICSEARCH_URL}/_security/_authenticate"]
Verified — authenticated as user "my-service" via API key. You're all set.
User: let's ingest some logs into my o11y project "siem-prod"
Agent: Let me find that project.
[runs: list --type observability]
Found "siem-prod" (ID: def456...). No saved credentials found for this project.
[runs: get --type observability --id def456...]
Endpoints set. Since there are no Elasticsearch credentials on file, I can reset the
admin bootstrap password to get initial access. Shall I proceed?
User: yes
Agent: [runs: reset-credentials --type observability --id def456...]
Credentials saved to .elastic-credentials — open that file to retrieve the password.
[runs: eval $(load-credentials --name siem-prod --include-admin)]
Admin credentials loaded for API key creation. Creating a scoped Elasticsearch API key
now — what access does it need?
User: read-only on logs-*
Agent: [creates scoped API key via elasticsearch-authn using admin credentials]
[appends API key to .elastic-credentials with project header]
[runs: eval $(load-credentials --name siem-prod)]
[verifies against ELASTICSEARCH_URL]
API key created and verified. Admin credentials removed from environment.
User: delete my elasticsearch project abc123...
Agent: Are you sure you want to delete project abc123...? This cannot be undone.
User: yes
python3 skills/cloud/manage-project/scripts/manage-project.py delete \
--type elasticsearch \
--id abc123def456abc123def456abc12345
cloud-setup skill first if EC_API_KEY is not set.cloud-create-project skill to create new projects — this skill handles existing projects only.search_power. Confirm the new value with the user first.max-retention-days. Data older than the new maximum is permanently deleted.get first and include any the user wants to keep.| Command | Description |
|---|---|
list | List projects by type |
get | Get project details by ID |
update | Update project name, alias, tags, or search_lake settings |
reset-credentials | Reset project credentials (new password) |
delete | Delete a project |
resume | Resume a suspended project |
| Variable | Required | Description |
|---|---|---|
EC_API_KEY | Yes | Elastic Cloud API key (project management operations) |
EC_BASE_URL | No | Cloud API base URL (default: https://api.elastic-cloud.com) |
ELASTICSEARCH_URL | Output | Elasticsearch URL (set after resolving a project for downstream skills) |
KIBANA_URL | Output | Kibana URL (set after resolving a project for downstream skills) |
Weekly Installs
140
Repository
GitHub Stars
136
First Seen
12 days ago
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
cursor126
github-copilot118
opencode117
gemini-cli117
codex117
amp117
Azure Data Explorer (Kusto) 查询技能:KQL数据分析、日志遥测与时间序列处理
133,300 周安装
--include-adminELASTICSEARCH_API_KEY is set. If only admin credentials are available, create a scoped API key via elasticsearch-authn. If that skill is not installed, ask the user to install it or create the key manually in Kibana > Stack Management > API keys.--type and --id (except list, which only needs --type).EC_API_KEY) for project management operations (list, get, update, delete). Elasticsearch operations require a separate Elasticsearch API key (ELASTICSEARCH_API_KEY) that authenticates against the project's Elasticsearch endpoint. Do not confuse the two.load-credentials | Load a project's saved credentials from .elastic-credentials |
| Flag | Commands |
| --- | --- |
--type | list, get, update, reset-credentials, delete, resume |
--id | get, update, reset-credentials, delete, resume, load-credentials |
--name | update, load-credentials |
--alias | update |
--tag | update |
--search-power | update |
--boost-window | update |
--max-retention-days | update |
--default-retention-days | update |
--include-admin | load-credentials |
--wait-seconds | reset-credentials |
APM_URL| Output |
| APM endpoint (observability projects only) |
INGEST_URL | Output | OTLP ingest endpoint (observability and security projects) |
ELASTICSEARCH_API_KEY | Output | Elasticsearch API key (for stack-level operations) |