UModel Root Cause Analysis
alibaba/UnifiedModel
Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments.
Guides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping.
Install Ecs Rfc Guide
$ npx skills add elastic/ecs --skill ecs-rfc-guide -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install elastic/ecs ecs-rfc-guide --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/elastic/ecs.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/ecs-rfc-guide .claude/skills/ecs-rfc-guide && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "ecs-rfc-guide" agent skill from https://github.com/elastic/ecs/tree/main/.agents/skills/ecs-rfc-guide into .claude/skills/ecs-rfc-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ecs-rfc-guide", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/elastic/ecs/tree/main/.agents/skills/ecs-rfc-guideType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add elastic/ecs --skill ecs-rfc-guide -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install elastic/ecs ecs-rfc-guide --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/elastic/ecs.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/ecs-rfc-guide .agents/skills/ecs-rfc-guide && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "ecs-rfc-guide" agent skill from https://github.com/elastic/ecs/tree/main/.agents/skills/ecs-rfc-guide into .agents/skills/ecs-rfc-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ecs-rfc-guide", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add elastic/ecs --skill ecs-rfc-guide -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install elastic/ecs ecs-rfc-guide --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/elastic/ecs.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/ecs-rfc-guide .cursor/skills/ecs-rfc-guide && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "ecs-rfc-guide" agent skill from https://github.com/elastic/ecs/tree/main/.agents/skills/ecs-rfc-guide into .cursor/skills/ecs-rfc-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ecs-rfc-guide", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/elastic/ecs.git --path .agents/skills/ecs-rfc-guide--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add elastic/ecs --skill ecs-rfc-guide -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install elastic/ecs ecs-rfc-guide --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/elastic/ecs.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/ecs-rfc-guide .gemini/skills/ecs-rfc-guide && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "ecs-rfc-guide" agent skill from https://github.com/elastic/ecs/tree/main/.agents/skills/ecs-rfc-guide into .gemini/skills/ecs-rfc-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ecs-rfc-guide", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install elastic/ecs ecs-rfc-guideInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add elastic/ecs --skill ecs-rfc-guide -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/elastic/ecs.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/ecs-rfc-guide .github/skills/ecs-rfc-guide && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "ecs-rfc-guide" agent skill from https://github.com/elastic/ecs/tree/main/.agents/skills/ecs-rfc-guide into .github/skills/ecs-rfc-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ecs-rfc-guide", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add elastic/ecs --skill ecs-rfc-guide -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install elastic/ecs ecs-rfc-guide --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/elastic/ecs.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/ecs-rfc-guide .opencode/skills/ecs-rfc-guide && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "ecs-rfc-guide" agent skill from https://github.com/elastic/ecs/tree/main/.agents/skills/ecs-rfc-guide into .opencode/skills/ecs-rfc-guide/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ecs-rfc-guide", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
ecs-rfc-guide- GitHub stars
- 1.1k
- Token cost
- ~1.2k tokens
- SKILL.md length
- 501 words
- Files
- 1
- Skills in repo
- 2
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Guides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping.
- Works in 5 steps: Single Proposal stage — template must… → Contributor opens a PR that adds the RFC… → Specify Target maturity: alpha, beta, or… → …
- A change needs an RFC
- SKILL.md covers When this applies, Current process (short), Template walkthrough and rfcs/text// folder, plus 6 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Ecs Rfc Guide is an agent skill from elastic/ecs, published by the product's own GitHub organization. Guides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping. Use when a change needs an RFC, when drafting or reviewing RFC PRs, or when the user asks how to propose new ECS field sets or substantial schema changes.
Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in DevOps & Cloud. It works with OpenTelemetry and Elasticsearch. The licence is Apache-2.0.
When your agent uses it
- A change needs an RFC
- Reviewing RFC PRs
- The user asks how to propose new ECS field sets
- Substantial schema changes
Example prompts
- “Use the ecs-rfc-guide skill to guide contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity…”
- “/ecs-rfc-guide”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Single Proposal stage — template must keep Stage: Proposal.
- Contributor opens a PR that adds the RFC markdown under rfcs/ (name like 0000-.md until numbered).
- Specify Target maturity: alpha, beta, or mixture (see Field stability).
- The PR author assigns the next available RFC number (scan rfcs/text/ for the highest existing number). ECS team reviews holistically and…
- If applicable, the RFC PR should include the schema changes (schemas/*.yml, generated artifacts, docs) at the agreed maturity level…
What it can do on your machine
Read from SKILL.md and the folder at commit 9868ff5. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Ecs Rfc Guide loads about 1.2k tokens when it runs. Until then it costs about 87 tokens; SKILL.md has 501 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from elastic/ecs at commit 9868ff5, republished under its Apache-2.0 licence (© elastic). 501 words, ~1,213 tokens.
Download SKILL.mdSave it as
.claude/skills/ecs-rfc-guide/SKILL.md (or your agent's skills folder).- name
- ecs-rfc-guide
- description
- Guides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping. Use when a change needs an RFC, when drafting or reviewing RFC PRs, or when the user asks how to propose new ECS field sets or substantial schema changes.
ECS RFC (Proposal) guide
When this applies
Use after ecs-pr-triage (or equivalent judgment) says Needs RFC, or when the user is starting a new field set, breaking change, novel use case, or ECS-wide design.
Authoritative process: rfcs/PROCESS.md. Template: rfcs/0000-rfc-template.md. High-level triggers: rfcs/README.md.
Current process (short)
- Single Proposal stage — template must keep
Stage: **Proposal**. - Contributor opens a PR that adds the RFC markdown under
rfcs/(name like0000-<dash-separated-name>.mduntil numbered). - Specify Target maturity:
alpha,beta, ormixture(see Field stability). - The PR author assigns the next available RFC number (scan
rfcs/text/for the highest existing number). ECS team reviews holistically and merges on approval. - If applicable, the RFC PR should include the schema changes (
schemas/*.yml, generated artifacts, docs) at the agreed maturity level — proposal and implementation land together in a single PR.
Template walkthrough
Copy rfcs/0000-rfc-template.md. Remove HTML comments as sections are filled.
| Section | What “good” looks like |
|---|---|
| Summary | 2–5 sentences: what, why, impact. |
| Usage | End-to-end: producer → storage → queries/dashboards/detections. |
| Fields | Every proposed field: name, type, description, level/maturity, example. Prefer YAML blocks. If object/flattened without children, justify shape and conflict avoidance (see schemas/README.md). |
| Source data | ≥2 real examples (JSON/logs); link or place large payloads under rfcs/text/<n>/. |
| Scope of impact | Ingestion (Beats/Agents), Kibana/apps, ECS repo (docs/tooling). |
| Concerns | Risks + resolved mitigations; OTel overlap; naming; adoption. |
| People | Author, SMEs, reviewers. |
| References | Prior art, semconv links, related issues/PRs. |
rfcs/text/<number>/ folder
When the RFC adds or changes fields:
- Create
rfcs/text/<number>/with standalone YAML snippets, large JSON examples, or mappings — especially when the markdown would be huge. - Use the next free folder number (scan
rfcs/text/; duplicates get fixed at merge per template notes). - Align filenames with affected field sets (e.g.
faas.yml,gen_ai.yaml) for reviewer navigation.
Show full SKILL.md (219 more words)Show less
OTel alignment (optional)
ECS tracks relationships between its fields and OTel semconv via otel: metadata tags in schemas/*.yml.
- When a new or changed field has a clear OTel semconv counterpart, adding an
otel:block (withrelation: match | equivalent | related | conflict | na) is encouraged but not required. - The
otel:metadata is used to generate alignment documentation — it is not a gate for merging. - If unsure whether an OTel mapping applies, omit it; it can be added later.
Maturity choice (alpha vs beta)
- Alpha — earlier, may change more; good for exploratory or fast-moving domains.
- Beta — clearer adoption path; still subject to change before GA.
- Mixture — some fields alpha, some beta; explain per field or group.
Promotion after merge is out of band from the RFC (team process per PROCESS.md).
PR hygiene
- Link the Proposal PR at the bottom of the RFC (
### RFC Pull Requests). - Do not replace process with old multi-stage labels found in historical RFCs under
rfcs/text/*.md; those are legacy examples only.
Example RFCs (depth reference)
- FaaS + service reuse: rfcs/text/0027-faas-fields.md + folder
rfcs/text/0027/. - GenAI security fields: rfcs/text/0050-gen_ai-security-fields.md.
Implementation in the RFC PR
The RFC PR itself should include the schema implementation: schemas/*.yml changes, make-generated artifacts, and a CHANGELOG.next.md entry. There is no separate "handoff" — proposal and schema land together.
Related
- Triage and routing: ecs-pr-triage skill; ecs-contribution-routing rule.
- YAML details: ecs-schema-standards rule.
© elastic, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .agents/skills/ecs-rfc-guide of elastic/ecs.
Open the folder on GitHubat commit 9868ff5
Compare with similar skills
Ecs Rfc Guide next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Ecs Rfc Guide this skillelastic/ecs | 1.1k | — | ~1.2k | Automated safety check: Pass | Apache-2.0 | |
| UModel Root Cause Analysisalibaba/UnifiedModel | 412 | — | ~1.9k | Automated safety check: Pass | Custom licence | |
| Aspire Diagnosticsexceptionless/Exceptionless | 2.5k | — | ~769 | Automated safety check: Pass | Apache-2.0 | |
| Kibana Otel Instrumentationelastic/kibana | 21k | — | ~5.1k | Automated safety check: Pass | Custom licence | |
| Observability Onboardingelastic/agent-skills | 592 | — | ~4.1k | Automated safety check: Pass | Apache-2.0 | |
| Observability K8s Investigationelastic/agent-skills | 592 | — | ~8.3k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Aspire Diagnostics
exceptionless/Exceptionless
Inspect local Aspire resource health, logs, traces, and browser telemetry.
- Official
Kibana Otel Instrumentation
elastic/kibana
Implement and quality-check OpenTelemetry metric instrumentation in Kibana code that uses @kbn/metrics.
- Official
Observability Onboarding
elastic/agent-skills
Onboard an application into Elastic Observability with the Elastic Distribution of OpenTelemetry (EDOT): route on language and runtime, detect and replace a classic Elastic APM agent, apply the…
- Official
Observability K8s Investigation
elastic/agent-skills
Investigate Kubernetes workload, node, and control-plane issues using OTel telemetry (EDOT).
- Official
Observability Sre Triage
elastic/agent-skills
Triage a degraded or suspect service end to end: read SLO status and burn rate, check active alerting rules and ML anomalies, measure throughput, latency, and error rate, assess dependency health…
More from elastic/ecs
- Official
Ecs PR Triage
elastic/ecs
Triages an ECS pull request. An agent skill from elastic/ecs.
Related
Works with
Categories
Questions about Ecs Rfc Guide
What does Ecs Rfc Guide do?
Guides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping. Ecs Rfc Guide is an agent skill from elastic/ecs, published by the product's own GitHub organization. Guides contributors through the Elastic Common Schema (ECS) RFC (Proposal) process: template sections, target maturity (alpha/beta), rfcs/text artifacts, and optional OTel mapping.
When should I use Ecs Rfc Guide?
Ecs Rfc Guide fits situations like: A change needs an RFC; reviewing RFC PRs; the user asks how to propose new ECS field sets; substantial schema changes.
How do I install Ecs Rfc Guide in Claude Code?
Run `npx skills add elastic/ecs --skill ecs-rfc-guide -a claude-code`. Or copy the skill folder (.agents/skills/ecs-rfc-guide in elastic/ecs) into .claude/skills/ecs-rfc-guide in your project. Claude Code loads it when a task matches its description.
How do I install Ecs Rfc Guide in Codex?
Run `npx skills add elastic/ecs --skill ecs-rfc-guide -a codex`. Or copy the skill folder (.agents/skills/ecs-rfc-guide in elastic/ecs) into .agents/skills/ecs-rfc-guide in your project. Codex loads it when a task matches its description.
Can I use Ecs Rfc Guide in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add elastic/ecs --skill ecs-rfc-guide -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/ecs-rfc-guide, .gemini/skills/ecs-rfc-guide, .github/skills/ecs-rfc-guide and .opencode/skills/ecs-rfc-guide in your project.
What does Ecs Rfc Guide need to run?
SKILL.md names no scripts, command-line tools or credentials: Ecs Rfc Guide is instructions for the agent only.
Does Ecs Rfc Guide access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Ecs Rfc Guide safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Ecs Rfc Guide use?
Ecs Rfc Guide is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Ecs Rfc Guide use?
About 1.2k tokens (SKILL.md is roughly 4.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Ecs Rfc Guide?
Skills that share tags, products or a category with Ecs Rfc Guide: UModel Root Cause Analysis (alibaba/UnifiedModel, 412 stars), Aspire Diagnostics (exceptionless/Exceptionless, 2.5k stars), Kibana Otel Instrumentation (elastic/kibana, 21k stars) and Observability Onboarding (elastic/agent-skills, 592 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Ecs Rfc Guide?
elastic (a GitHub organization, an official publisher) maintains it in elastic/ecs, which has 1,123 GitHub stars. The repository holds 2 skills in this directory. The repository was last updated on October 7, 2026.
Source: elastic/ecs on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.