Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Elasticsearch design and operations expertise covering index design, mapping types, custom analyzer configuration, search query construction (bool, multi-match, function_score), aggregations, index lifecycle management, cluster sizing and architecture, performance tuning, and Kibana dashboard creation.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
493 lines · 1,599 words
Elasticsearch is a distributed search and analytics engine built on Apache Lucene. It excels at full-text search, log analytics, and real-time aggregations. Success requires understanding how data flows from ingestion through analysis to inverted indexes, and how to design mappings and queries that leverage this architecture.
Elasticsearch design and operations expertise covering index design, mapping types, custom analyzer configuration, search query construction (bool, multi-match, function_score), aggregations, index lifecycle management, cluster sizing and architecture, performance tuning, and Kibana dashboard creation.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Elasticsearch Engineer skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
What it covers
Core Philosophy
Index Design
Analyzer Configuration
Search Queries
Aggregations
Index Lifecycle Management (ILM)
Cluster Sizing
Performance Tuning
Kibana Dashboard Design
When to Use
Output Format
Example
Edge Cases
PUT /products
{
"settings": {
"number_of_shards": 3,
"number_of_replicas": 1,
"index.codec": "best_compression",
"analysis": {
"analyzer": {
"product_analyzer": {
"type": "custom",
"tokenizer": "standard",
"filter": ["lowercase", "asciifolding", "product_synonyms", "english_stemmer"]
},
"autocomplete_analyzer": {
# ... (condensed) ...
"type": "boolean"
}
}
}
}| Data Type | ES Field Type | Use Case |
|---|---|---|
| Full-text | text | Search/match queries, analyzed |
| Exact match | keyword | Filtering, sorting, aggregations |
| Both | text + keyword subfield | Search + filter/sort |
| Numbers | integer, long, double, scaled_float | Range queries, sorting |
| Dates | date | Time-based queries, date math |
| Boolean | boolean | Filtering |
| Geo | geo_point, geo_shape | Location queries |
| Objects | object (default), nested, flattened | Structured data |
| IP | ip | CIDR range queries |
| Dense vector | dense_vector | kNN / vector similarity search |
// PROBLEM with object type: cross-object matching
// If you store: [{"color": "red", "size": "L"}, {"color": "blue", "size": "S"}]
// A query for color=red AND size=S would INCORRECTLY match (cross-object)
// SOLUTION: Use nested type
"attributes": {
"type": "nested",
"properties": {
"color": { "type": "keyword" },
"size": { "type": "keyword" }
}
}
// Query with nested query
# ... (condensed) ...
}
}
}
}
}An analyzer consists of: Character Filters -> Tokenizer -> Token Filters
// Custom analyzer for product search
{
"analysis": {
"char_filter": {
"html_strip": { "type": "html_strip" },
"ampersand_replace": {
"type": "pattern_replace",
"pattern": "&",
"replacement": "and"
}
},
"tokenizer": {
"product_tokenizer": {
"type": "pattern",
# ... (condensed) ...
"filter": ["lowercase", "english_possessive", "english_stop", "english_stemmer"]
}
}
}
}// Test how text is analyzed
POST /_analyze
{
"analyzer": "english_product",
"text": "The quick brown fox's running & jumping"
}
// Result tokens: ["quick", "brown", "fox", "run", "and", "jump"]
// Test with specific index analyzer
POST /products/_analyze
{
"field": "name",
"text": "Wireless Bluetooth Mouse"
}GET /products/_search
{
"query": {
"bool": {
"must": [
{ "multi_match": {
"query": "wireless mouse",
"fields": ["name^3", "description", "tags^2"],
"type": "best_fields",
"fuzziness": "AUTO"
}}
],
"filter": [
{ "term": { "category": "electronics" } },
# ... (condensed) ...
},
"from": 0,
"size": 20,
"_source": ["name", "price", "category", "in_stock"]
}// best_fields: Score from best matching field (default)
{ "multi_match": { "query": "q", "fields": ["title^3", "body"], "type": "best_fields" } }
// most_fields: Sum scores from all matching fields
{ "multi_match": { "query": "q", "fields": ["title", "title.stemmed", "title.ngram"], "type": "most_fields" } }
// cross_fields: Treats all fields as one big field (good for name = first + last)
{ "multi_match": { "query": "John Smith", "fields": ["first_name", "last_name"], "type": "cross_fields" } }
// phrase_prefix: Autocomplete / search-as-you-type
{ "multi_match": { "query": "wire mou", "fields": ["name"], "type": "phrase_prefix" } }GET /products/_search
{
"query": {
"function_score": {
"query": { "multi_match": { "query": "laptop", "fields": ["name", "description"] } },
"functions": [
{
"field_value_factor": {
"field": "popularity",
"factor": 1.2,
"modifier": "log1p",
"missing": 1
},
"weight": 2
# ... (condensed) ...
"boost_mode": "multiply",
"max_boost": 10
}
}
}// Define dense vector field
PUT /embeddings
{
"mappings": {
"properties": {
"content_vector": {
"type": "dense_vector",
"dims": 768,
"index": true,
"similarity": "cosine"
}
}
}
}
# ... (condensed) ...
"k": 10,
"num_candidates": 100
},
"fields": ["title", "content"]
}GET /orders/_search
{
"size": 0,
"aggs": {
"total_revenue": { "sum": { "field": "total" } },
"avg_order_value": { "avg": { "field": "total" } },
"order_stats": {
"stats": { "field": "total" }
},
"percentile_values": {
"percentiles": { "field": "response_time_ms", "percents": [50, 90, 95, 99] }
},
"unique_customers": {
"cardinality": { "field": "customer_id", "precision_threshold": 3000 }
}
}
}GET /orders/_search
{
"size": 0,
"aggs": {
"by_status": {
"terms": { "field": "status", "size": 20 },
"aggs": {
"revenue": { "sum": { "field": "total" } },
"avg_total": { "avg": { "field": "total" } }
}
},
"orders_over_time": {
"date_histogram": {
"field": "created_at",
# ... (condensed) ...
]
}
}
}
}PUT _ilm/policy/logs_policy
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_primary_shard_size": "50gb",
"max_age": "1d"
},
"set_priority": { "priority": 100 }
}
},
# ... (condensed) ...
"number_of_shards": 3,
"number_of_replicas": 1
}
}
}Target shard size: 10-50 GB per shard
Max shards per node: ~600-1000 (depends on heap)
Heap per shard: ~1-2 MB overhead per shard
JVM heap: 50% of RAM, max 31 GB (compressed oops threshold)
Rule of thumb: number_of_shards = ceil(expected_data_size / 30GB)
# Master-eligible nodes (3 minimum, small instances)
node.roles: [master]
# Heap: 1-4 GB, no storage needed
# Hot data nodes (high CPU, fast SSD storage)
node.roles: [data_hot, data_content]
# Heap: 16-31 GB, fast NVMe storage
# Warm data nodes (moderate CPU, larger cheaper storage)
node.roles: [data_warm]
# Heap: 16-31 GB, standard SSD storage
# Cold data nodes (minimal CPU, large HDD storage)
node.roles: [data_cold]
# Heap: 8-16 GB, HDD storage
# Coordinating-only nodes (query routing / aggregation)
node.roles: []
# Heap: 16-31 GB, no storage needed
# ML nodes
node.roles: [ml, remote_cluster_client]// Bulk indexing settings (revert after bulk load)
PUT /my_index/_settings
{
"index": {
"refresh_interval": "30s",
"number_of_replicas": 0,
"translog.durability": "async",
"translog.sync_interval": "30s"
}
}
// Use bulk API (optimal batch: 5-15 MB per request)
POST /_bulk
{"index":{"_index":"products","_id":"1"}}
{"name":"Widget","price":9.99}
{"index":{"_index":"products","_id":"2"}}
{"name":"Gadget","price":19.99}// Use filter context for non-scoring clauses (cacheable)
// Use routing to target specific shards
GET /orders/_search?routing=customer_123
{
"query": {
"bool": {
"filter": [
{ "term": { "customer_id": "customer_123" } },
{ "range": { "created_at": { "gte": "2025-01-01" } } }
]
}
}
}
// Profile slow queries
GET /products/_search
{
"profile": true,
"query": { "match": { "name": "wireless mouse" } }
}// Cluster health
GET _cluster/health?level=indices
// Hot threads
GET _nodes/hot_threads
// Pending tasks
GET _cluster/pending_tasks
// Shard allocation explanation
GET _cluster/allocation/explain
// Index stats
GET /my_index/_stats
// Node stats
GET _nodes/stats/jvm,os,processTop row: Key KPIs (metric visualizations) -- total count, error rate, p95 latency
Second row: Time-series line charts showing trends
Third row: Breakdown charts -- bar charts by category, pie charts for distribution
Bottom row: Data table with top items, and a saved search for drill-down
// Runtime field for computed values without re-indexing
PUT /orders/_mapping
{
"runtime": {
"profit_margin": {
"type": "double",
"script": "(doc['revenue'].value - doc['cost'].value) / doc['revenue'].value * 100"
},
"day_of_week": {
"type": "keyword",
"script": "emit(doc['created_at'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))"
}
}
}Use this skill when:
Designing or implementing elasticsearch engineer solutions
Reviewing or improving existing elasticsearch engineer approaches
Making architectural or implementation decisions about elasticsearch engineer
Learning elasticsearch engineer patterns and best practices
Troubleshooting elasticsearch engineer-related issues
Do NOT use this skill when:
The question is about a fundamentally different technology domain
A more specific sibling skill covers the exact topic needed
The user needs a complete hands-on tutorial rather than expert guidance
# Elasticsearch Engineer Analysis
## Context Assessment
[Situation summary and constraints]
## Recommended Approach
[Primary recommendation with rationale]
## Implementation Steps
1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]
## Trade-offs and Considerations
- [Key trade-off 1]
- [Key trade-off 2]
## Next Steps
- [Immediate action item]
- [Follow-up action item]Input: "Help me implement elasticsearch engineer for a medium-scale production application"
Output: A structured analysis covering current state assessment, recommended elasticsearch engineer approach with specific patterns, implementation roadmap with milestones, and risk mitigation strategies tailored to the application scale and constraints.
Legacy system integration: When elasticsearch engineer must coexist with legacy approaches, provide a gradual migration path rather than a complete rewrite
Scale mismatch: When the solution complexity exceeds the project scale, recommend a simpler approach and note when to revisit
Team skill gaps: When the team lacks experience with the recommended approach, include learning resources and simpler alternatives
Conflicting requirements: When constraints conflict (e.g., performance vs. maintainability), explicitly state the trade-off and recommend based on stated priorities
SKILL.md
493 lines · 1,599 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Elasticsearch Engineer bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for