New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Observability Logs Search

by aspectrr in aspectrr/deer

Search and filter Observability logs using ES|QL. An agent skill from aspectrr/deer.

MITAuto-check passedDevOps & Cloud

Install Observability Logs Search

skills CLI
$ npx skills add aspectrr/deer --skill observability-logs-search -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install aspectrr/deer observability-logs-search --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/aspectrr/deer.git skills-src && mkdir -p .claude/skills && cp -r skills-src/deer-cli/internal/skill/defaults/observability-logs-search .claude/skills/observability-logs-search && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
observability-logs-search
GitHub stars
405
Token cost
~1.3k tokens
SKILL.md length
376 words
Files
1
Skills in repo
14
Repo updated
First seen
Licence
MIT

At a glance

Search and filter Observability logs using ES|QL. An agent skill from aspectrr/deer.

  • Works in 5 steps: Round 1 — broad: Run a query with only… → Inspect: Look at the histogram, sample… → Round 2 — exclude noise: Add NOT clauses… → …
  • Investigating log spikes
  • SKILL.md covers Parameter conventions, The funnel workflow, ES|QL patterns for log search and Examples, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Observability Logs Search is an agent skill from aspectrr/deer. Search and filter Observability logs using ES|QL. Use when investigating log spikes, errors, or anomalies; getting volume and trends; or drilling into services or containers during incidents.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Observability. It works with Microsoft Sentinel and Kubernetes. The repository describes itself as: 🦌 The AI Elasticsearch Engineer. The licence is MIT.

When your agent uses it

  • Investigating log spikes
  • Getting volume and trends
  • Drilling into services
  • Containers during incidents

Example prompts

  • “/observability-logs-search”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Round 1 — broad: Run a query with only the scope filter and time range.
  2. Inspect: Look at the histogram, sample messages, and categorized patterns.
  3. Round 2 — exclude noise: Add NOT clauses to the KQL filter for dominant noise patterns.
  4. Repeat: Keep adding NOTs until fewer than 20 log patterns remain.
  5. Pivot (optional): Once the funnel isolates a specific entity, run one more query focused on that entity.

What it can do on your machine

Read from SKILL.md and the folder at commit e4f9845. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are json).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Observability Logs Search loads about 1.3k tokens when it runs. Until then it costs about 54 tokens; SKILL.md has 376 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~54
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aspectrr/deer at commit e4f9845, republished under its MIT licence (© aspectrr). 376 words, ~1,275 tokens.

Download SKILL.mdSave it as .claude/skills/observability-logs-search/SKILL.md (or your agent's skills folder).
name
observability-logs-search
description
Search and filter Observability logs using ES|QL. Use when investigating log spikes, errors, or anomalies; getting volume and trends; or drilling into services or containers during incidents.
metadata.author
elastic
metadata.version
0.2.0
metadata.source
elastic/agent-skills//skills/observability/logs-search

Search and filter logs to support incident investigation. The workflow mirrors Kibana Discover: apply a time range and scope filter, then iteratively add exclusion filters (NOT) until a small, interesting subset of logs remains. Use ES|QL only (POST /_query); do not use Query DSL.

Parameter conventions

ParameterTypeDescription
startstringStart of time range (Elasticsearch date math, e.g. now-1h)
endstringEnd of time range (e.g. now)
kqlFilterstringKQL query string to narrow results
limitnumberMaximum log samples to return (e.g. 10–100)
groupBystringOptional field to group the histogram by (e.g. log.level, service.name)
Context minimization

Keep the context window small. In the sample branch of the query, KEEP only a subset of fields; do not return full documents by default.

Recommended KEEP list for sample logs: message, error.message, service.name, container.name, host.name, container.id, agent.name, kubernetes.container.name, kubernetes.node.name, kubernetes.namespace, kubernetes.pod.name

The funnel workflow

You must iterate. Do not stop after one query. Keep excluding noise with NOT until fewer than 20 log patterns remain.

  1. Round 1 — broad: Run a query with only the scope filter and time range.
  2. Inspect: Look at the histogram, sample messages, and categorized patterns.
  3. Round 2 — exclude noise: Add NOT clauses to the KQL filter for dominant noise patterns.
  4. Repeat: Keep adding NOTs until fewer than 20 log patterns remain.
  5. Pivot (optional): Once the funnel isolates a specific entity, run one more query focused on that entity.
Show full SKILL.md (137 more words)Show less

Use ES|QL (POST /_query) only. Always return: a time-series histogram, total count, a small sample of logs, and message categorization. Use FORK to compute all in a single query.

Basic log search with histogram, samples, and categorization
json
POST /_query
{
  "query": "FROM logs-* METADATA _id, _index | WHERE @timestamp >= TO_DATETIME(\"2025-03-06T10:00:00.000Z\") AND @timestamp <= TO_DATETIME(\"2025-03-06T11:00:00.000Z\") | FORK (STATS count = COUNT(*) BY bucket = BUCKET(@timestamp, 1m) | SORT bucket) (STATS total = COUNT(*)) (SORT @timestamp DESC | LIMIT 10 | KEEP _id, _index, message, error.message, service.name, container.name, host.name) (LIMIT 10000 | STATS COUNT(*) BY CATEGORIZE(message) | SORT `COUNT(*)` DESC | LIMIT 20) (LIMIT 10000 | STATS COUNT(*) BY CATEGORIZE(message) | SORT `COUNT(*)` ASC | LIMIT 20)"
}
Adding a KQL filter
json
POST /_query
{
  "query": "FROM logs-* METADATA _id, _index | WHERE @timestamp >= TO_DATETIME(\"2025-03-06T10:00:00.000Z\") AND @timestamp <= TO_DATETIME(\"2025-03-06T11:00:00.000Z\") | WHERE KQL(\"service.name: checkout AND log.level: error\") | FORK (STATS count = COUNT(*) BY bucket = BUCKET(@timestamp, 1m) | SORT bucket) (STATS total = COUNT(*)) (SORT @timestamp DESC | LIMIT 10 | KEEP _id, _index, message, error.message, service.name) (LIMIT 10000 | STATS COUNT(*) BY CATEGORIZE(message) | SORT `COUNT(*)` DESC | LIMIT 20) (LIMIT 10000 | STATS COUNT(*) BY CATEGORIZE(message) | SORT `COUNT(*)` ASC | LIMIT 20)"
}

Examples

Last hour of logs for a service
json
POST /_query
{
  "query": "FROM logs-* METADATA _id, _index | WHERE @timestamp >= NOW() - 1 hour AND @timestamp <= NOW() | WHERE KQL(\"service.name: api-gateway\") | SORT @timestamp DESC | LIMIT 20"
}
Error logs with trend and samples
json
POST /_query
{
  "query": "FROM logs-* METADATA _id, _index | WHERE @timestamp >= NOW() - 2 hours AND @timestamp <= NOW() | WHERE KQL(\"log.level: error\") | FORK (STATS count = COUNT(*) BY bucket = BUCKET(@timestamp, 5m) | SORT bucket) (STATS total = COUNT(*)) (SORT @timestamp DESC | LIMIT 15)"
}

Guidelines

  • Funnel: iterate with NOT. Do not report findings after a single broad query.
  • Histogram first: Use the trend to see when spikes or drops occur.
  • Context minimization: KEEP only summary fields; default LIMIT 10–20, cap at 500.
  • Request body escaping: The query value is JSON. Escape double quotes: \" for the KQL wrapper.
  • Use Elasticsearch date math for start and end.
  • Choose bucket size from the time range: aim for roughly 20–50 buckets.
  • Prefer ECS field names.

© aspectrr, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in deer-cli/internal/skill/defaults/observability-logs-search of aspectrr/deer.

Open the folder on GitHubat commit e4f9845

Compare with similar skills

Observability Logs Search next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Observability Logs Search compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Observability Logs Search this skillaspectrr/deer405—~1.3kAutomated safety check: PassMIT
Azure Diagnosticsmicrosoft/azure-skills1.5k1 repos~1.6kAutomated safety check: PassMIT
Kubeshark KFL2 Filter Referencekubeshark/kubeshark12k—~3.6kAutomated safety check: PassApache-2.0
Apex Azure Diagnosticsjonathan-vella/apex217—~2.1kAutomated safety check: PassMIT
Logfire Infrastructurepydantic/skills140—~1.8kAutomated safety check: PassMIT
KubeSphere WizTelemetry Tracingkubesphere/kubesphere17k1 repos~4.6kAutomated safety check: PassCustom licence

Similar skills

  • Azure Diagnostics

    microsoft/azure-skills

    Official

    Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage.

    1.5k GitHub starsUsed in 1 repo~1.6k tokens
    DevOps & CloudAuto-check passed

  • Kubeshark KFL2 Filter Reference

    kubeshark/kubeshark

    Syntax reference for KFL2, the CEL-based display filter language used to search Kubernetes network traffic captured by Kubeshark, loaded before any filter is written.

    12k GitHub stars~3.6k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Apex Azure Diagnostics

    jonathan-vella/apex

    WORKFLOW SKILL — Debug Azure production issues: Container Apps, Functions, App Service, AKS, VMs and messaging, with KQL log analysis.

    217 GitHub stars~2.1k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Logfire Infrastructure

    pydantic/skills

    Official

    Monitor hosts, Docker containers, Kubernetes clusters, database/queue/cache servers, and cloud-provider metrics with Pydantic Logfire — no application code required.

    140 GitHub stars~1.8k tokensUpdated 7 days ago
    DevOps & CloudAuto-check passed

  • KubeSphere WizTelemetry Tracing

    kubesphere/kubesphere

    Installs and configures WizTelemetry Tracing for KubeSphere, an OpenTelemetry-based tracing extension, and covers its components, query API and auto-instrumentation.

    17k GitHub starsUsed in 1 repo~4.6k tokens
    DevOps & CloudAuto-check passed

  • Error Handler

    EliasOulkadi/shokunin

    Design error handling, structured logging, and observability with OpenTelemetry (traces, metrics, logs), error classification, recovery patterns (retry with jitter, circuit breaker, bulkhead…

    114 GitHub stars~3.6k tokensUpdated 3 days ago
    DevOps & CloudAuto-check: notes

More from aspectrr/deer

All 14 skills in this repo

  • Elasticsearch Audit

    aspectrr/deer

    Enable, configure, and query Elasticsearch security audit logs.

    405 GitHub stars~1.7k tokensUpdated 5 mo ago
    Auto-check passed

  • Elasticsearch Authn

    aspectrr/deer

    Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms.

    405 GitHub stars~1.2k tokensUpdated 5 mo ago
    Auto-check: notes

  • Elasticsearch Authz

    aspectrr/deer

    Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security.

    405 GitHub stars~1.8k tokensUpdated 5 mo ago
    Auto-check passed

  • Elasticsearch File Ingest

    aspectrr/deer

    Ingest and transform data files (CSV/JSON/Parquet/Arrow IPC) into Elasticsearch with stream processing and custom transforms.

    405 GitHub stars~684 tokensUpdated 5 mo ago
    Auto-check passed

  • Elasticsearch Security Troubleshooting

    aspectrr/deer

    Diagnose and resolve Elasticsearch security errors: 401/403 failures, TLS problems, expired API keys, role mapping mismatches, and Kibana login issues.

    405 GitHub stars~4.9k tokensUpdated 5 mo ago
    Auto-check passed

  • Kafka

    aspectrr/deer

    Kafka topic management, consumer group monitoring, message production/consumption, and cluster health diagnostics.

    405 GitHub stars~946 tokensUpdated 5 mo ago
    Auto-check passed

Works with

Categories

Questions about Observability Logs Search

What does Observability Logs Search do?

Search and filter Observability logs using ES|QL. An agent skill from aspectrr/deer. Observability Logs Search is an agent skill from aspectrr/deer. Search and filter Observability logs using ES|QL.

When should I use Observability Logs Search?

Observability Logs Search fits situations like: investigating log spikes; getting volume and trends; drilling into services; containers during incidents.

How do I install Observability Logs Search in Claude Code?

Run `npx skills add aspectrr/deer --skill observability-logs-search -a claude-code`. Or copy the skill folder (deer-cli/internal/skill/defaults/observability-logs-search in aspectrr/deer) into .claude/skills/observability-logs-search in your project. Claude Code loads it when a task matches its description.

How do I install Observability Logs Search in Codex?

Run `npx skills add aspectrr/deer --skill observability-logs-search -a codex`. Or copy the skill folder (deer-cli/internal/skill/defaults/observability-logs-search in aspectrr/deer) into .agents/skills/observability-logs-search in your project. Codex loads it when a task matches its description.

Can I use Observability Logs Search in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aspectrr/deer --skill observability-logs-search -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/observability-logs-search, .gemini/skills/observability-logs-search, .github/skills/observability-logs-search and .opencode/skills/observability-logs-search in your project.

What does Observability Logs Search need to run?

SKILL.md names no scripts, command-line tools or credentials: Observability Logs Search is instructions for the agent only.

Does Observability Logs Search access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Observability Logs Search safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Observability Logs Search use?

Observability Logs Search is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Observability Logs Search use?

About 1.3k tokens (SKILL.md is roughly 5.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Observability Logs Search?

Skills that share tags, products or a category with Observability Logs Search: Azure Diagnostics (microsoft/azure-skills, 1.5k stars), Kubeshark KFL2 Filter Reference (kubeshark/kubeshark, 12k stars), Apex Azure Diagnostics (jonathan-vella/apex, 217 stars) and Logfire Infrastructure (pydantic/skills, 140 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Observability Logs Search?

aspectrr (a GitHub user) maintains it in aspectrr/deer, which has 405 GitHub stars. The repository holds 14 skills in this directory. The repository was last updated on April 21, 2026.

Source: aspectrr/deer on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.