Elastic Integration Skills

Integration Skills

Agent workflows for building and maintaining Elastic integrations — works with Cursor, Claude Code, Codex, and any LLM-powered coding environment.

Beta — This is the initial release. Skills are under active development — expect changes, and please report any issues you find.

What is this?

Integration Skills is a public collection of agentic workflows that cover the full lifecycle of building, reviewing, and maintaining Elastic integration packages. The skills are LLM-agnostic by design: they work with whatever AI-powered coding environment you already use — Cursor, Claude Code, Codex, or anything else that can read skill/instruction files from a directory.

The toolkit is organized around two top-level skills that cover the core lifecycle of an Elastic integration:

• /research-integration — Researches a vendor, product, or feature before you start building. Investigates API documentation, data collection methods, sample data formats, and ECS mapping candidates. Produces a structured research brief that feeds directly into /create-integration.
• /create-integration — Scaffolds a new integration package end-to-end: package creation, data stream scaffolding, manifest configuration, CEL programs, ingest pipelines, field mappings, and system tests.

Together, these skills turn integration development from a slow, manual process into a fast, structured, agent-assisted workflow.

Who this is for

This toolkit is designed for engineers who:

• Build or maintain Elastic integration packages — whether as contributors to elastic/integrations, as Elastic partners, or as independent developers building custom integrations
• Are familiar with the Elastic Stack (Elasticsearch, Kibana, Elastic Agent) at an integration-development level
• Want structured, repeatable, agent-assisted workflows instead of figuring out each integration from scratch

Recommended knowledge

You will get the most out of these skills if you are comfortable with:

• Elastic Agent and integrations — how integration packages are structured, how data streams work, and the basics of the elastic-package CLI. The Elastic integrations developer guide is the canonical reference.
• Elastic Common Schema (ECS) — field naming conventions and event categorization. See the ECS reference.
• Ingest pipelines — Elasticsearch ingest pipeline fundamentals (processors, conditions, error handling). See the ingest pipeline docs.
• CEL programs (for REST API integrations) — the Common Expression Language as used in Elastic Agent's CEL input type. See the Elastic Agent CEL input docs.

Getting started

Requirements

The following tools must be installed and available on $PATH for the agent workflows to function.

Tool	Purpose	Install
Docker	Runs the Elastic Stack for system tests and service containers	Official docs
elastic-package	CLI for building, linting, formatting, and testing integration packages	go install github.com/elastic/elastic-package@latest
celfmt	Canonical formatter and simplifier for CEL programs in agent integration configs	go install github.com/elastic/celfmt/cmd/celfmt@latest
stream	Mock service for testing integration scripts	go install github.com/elastic/stream@latest
mito	CEL debugging and playground tool for prototyping against live or mock data	go install github.com/elastic/mito/cmd/mito@latest
ceplx	CEL cyclomatic and cognitive complexity assessment tool	go install github.com/efd6/ceplx/cmd/ceplx@latest
kbdash	Extracts structured text descriptions from Kibana dashboard JSON for readable diffs	go install github.com/efd6/kbdash@latest

All Go tools require a working Go installation with $GOPATH/bin on your $PATH.

npx (Recommended)

The fastest way to install skills is with the skills CLI. No need to clone this repository — just run: