MCPInstall

kibana-streams

by elasticBackend & APIs

List, inspect, enable, disable, and resync Kibana Streams via the REST API. Use when the user needs stream details, ingest settings, query-stream settings, or linked attachments (dashboards, rules, SLOs).

Installs
2.9K
Last 24h
—
Trending rank
—
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/elastic/agent-skills --skill kibana-streams
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads kibana-streams automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Kibana Streams

Read stream metadata, settings, and attachments, and manage stream lifecycle (enable, disable, resync) via the Kibana Streams REST API. Streams are an experimental way to manage data in Kibana — expect API and behavior changes. This skill covers read operations and lifecycle only; create, update, delete, fork, and other mutating operations may be added in a later version.

For detailed endpoints and parameters, see references/streams-api-reference.md.

When to use

  • Listing all streams or getting a single stream's definition and metadata
  • Reading a stream's ingest settings, or the ES|QL definition of a query stream
  • Listing attachments (dashboards, rules, SLOs) linked to a stream
  • Enabling, disabling, or resyncing streams

Prerequisites

ItemDescription
Kibana URLKibana endpoint (e.g. https://localhost:5601 or a Cloud deployment URL)
AuthenticationAPI key or basic auth (see the elasticsearch-authn skill)
Privilegesread_stream for read operations; manage_stream for lifecycle APIs

Use the space-scoped path /s/{space_id}/api/streams when operating in a non-default space. For role configuration (Kibana feature privileges and Elasticsearch-level permissions), refer to Streams required permissions.

API base and headers

  • Base path: GET or POST to <kibana_url>/api/streams (or /s/<space_id>/api/streams for a space).
  • Read operations: Typically do not require extra headers; follow the official API docs for each endpoint.
  • Lifecycle operations: POST /api/streams/_disable, _enable, and _resync are mutating — send kbn-xsrf: true (or equivalent) as required by your Kibana version.

Operations (read + lifecycle)

Read

OperationMethodPath
Get stream listGET/api/streams
Get a streamGET/api/streams/{name}
Get ingest stream settingsGET/api/streams/{name}/_ingest
Get query stream settingsGET/api/streams/{name}/_query
Get stream attachmentsGET/api/streams/{streamName}/attachments

Lifecycle

OperationMethodPath
Disable streamsPOST/api/streams/_disable
Enable streamsPOST/api/streams/_enable
Resync streamsPOST/api/streams/_resync

Path parameters: {name} and {streamName} are the stream identifier (same value; the API docs use both names).

Lifecycle and retention (ingest settings)

Ingest settings (GET /api/streams/{name}/_ingest) expose two separate lifecycle areas:

  • Stream lifecycle (ingest.lifecycle) — Controls how long the stream's data is retained. Use lifecycle.dsl.data_retention (e.g. "30d") for explicit retention, or lifecycle.inherit for child streams. This is what users usually mean when they ask to "set retention", "update retention", or "change the stream's retention".
  • Failure store lifecycle (ingest.failure_store.lifecycle) — Controls retention of failed documents only (documents that did not process successfully). Users rarely need to change this unless they explicitly mention the failure store or failed-document retention.

When a user asks to set or update retention, target the stream's main lifecycle (lifecycle.dsl.data_retention), not the failure store, unless they specifically ask about failure store or failed documents.

Examples

List streams

curl -X GET "${KIBANA_URL}/api/streams" \
  -H "Authorization: ApiKey <base64-api-key>"

Get a single stream

curl -X GET "${KIBANA_URL}/api/streams/my-stream" \
  -H "Authorization: ApiKey <base64-api-key>"

Get query stream settings

curl -X GET "${KIBANA_URL}/api/streams/my-stream/_query" \
  -H "Authorization: ApiKey <base64-api-key>"

Get stream attachments

# Attachments (dashboards, rules, SLOs linked to the stream)
curl -X GET "${KIBANA_URL}/api/streams/my-stream/attachments" \
  -H "Authorization: ApiKey <base64-api-key>"

Disable, enable, or resync streams

# Disable streams (request body per API docs) — deletes wired stream data; warn and confirm before proceeding
curl -X POST "${KIBANA_URL}/api/streams/_disable" \
  -H "Authorization: ApiKey <base64-api-key>" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{}'

# Enable streams
curl -X POST "${KIBANA_URL}/api/streams/_enable" \
  -H "Authorization: ApiKey <base64-api-key>" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{}'

# Resync streams
curl -X POST "${KIBANA_URL}/api/streams/_resync" \
  -H "Authorization: ApiKey <base64-api-key>" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{}'

Check the Streams API operation pages for request/response bodies (e.g. request body for _disable/_enable/_resync if required).

Guidelines

  • When the user asks to set or update retention, assume they mean the stream's data retention (ingest.lifecycle / lifecycle.dsl.data_retention). Do not change only the failure store retention unless they explicitly ask about the failure store or failed documents.
  • Other mutating operations (create, update, delete, fork, attachment management, and more) are not supported by this skill. See references/streams-api-reference.md for the full list of deferred operations.
  • Significant events and their detection queries are out of scope. Requests about significant events, SigEvents, or Knowledge Indicators belong to the dedicated significant-events skill, which uses the platform.sig_events.* Agent Builder tools. The /api/streams/{name}/queries and /api/streams/{name}/significant_events endpoints are deprecated and pending removal in Kibana — do not reach for them here.
  • Do not confuse a query stream with a significant-event query. /api/streams/{name}/_query is the ES|QL definition of a query stream (a stream type, alongside wired and classic); it has nothing to do with detection queries.
  • Disabling streams can lead to data loss for wired streams. The disable API deletes wired stream data (classic stream data is preserved). Before calling disable, warn the user and confirm they understand the risk (and have backed up or no longer need the data).
  • Prefer read operations when the user only needs to inspect stream state; use lifecycle APIs when they need to enable, disable, or resync streams.

FAQ

What does the kibana-streams skill do?

List, inspect, enable, disable, and resync Kibana Streams via the REST API. Use when the user needs stream details, ingest settings, query-stream settings, or linked attachments (dashboards, rules, SLOs).

How do I install kibana-streams?

Run npx skills add https://github.com/elastic/agent-skills --skill kibana-streams in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/kibana-streams/ (personal) or .claude/skills/kibana-streams/ (project).

Which AI agents can use kibana-streams?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is kibana-streams safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains kibana-streams?

It is published by elastic in elastic/agent-skills. It has 2,931 recorded installs.

More from elastic/agent-skills

View all →

elasticsearch-esql

elastic/agent-skills

Execute ESQL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ESQL results.

AI & Agents4.8K installs

elasticsearch-onboarding

elastic/agent-skills

Help developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and building a search experience with best practices baked in. Use this when the user shows intent to build search-related functionality, asks about Elasticsearch-related concepts for their use case, or expresses the need for help getting started with Elasticsearch.

AI & Agents4.4K installs

kibana-dashboards

elastic/agent-skills

Create and manage Kibana Dashboards and Lens visualizations. Use when you need to define dashboards and visualizations declaratively, version control them, or automate their deployment.

AI & Agents4.3K installs

security-case-management

elastic/agent-skills

Create, search, update, and manage SOC cases via the Kibana Cases API. Use when tracking incidents, linking alerts to cases, adding investigation notes, or managing triage output.

Security4.1K installs

kibana-alerting-rules

elastic/agent-skills

Create and manage Kibana alerting rules. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze), choosing metric threshold rule types and params, or read-only find/list with tag filters.

AI & Agents4K installs

kibana-agent-builder

elastic/agent-skills

Create and manage Kibana Agent Builder agents and custom tools. Use when asked to create, update, delete, test, or inspect agents or tools in Agent Builder, or when the user wants to understand what agents or tools already exist.

AI & Agents4K installs

Popular backend & apis skills

View category →

find-skills

vercel-labs/skills

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.

OfficialBackend & APIs4.1M installs

entra-app-registration

microsoft/azure-skills

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

OfficialBackend & APIs566.7K installs

google-agents-cli-adk-code

google/agents-cli

This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).

Backend & APIs514.8K installs

embedded-captions

heygen-com/hyperframes

Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.

Backend & APIs453.3K installs

entra-agent-id

microsoft/azure-skills

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).

OfficialBackend & APIs336.6K installs

neon

neondatabase/agent-skills

Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.

Backend & APIs237.1K installs