Nightshift
Nightshift is an AI-powered observability product built into Elastic. It analyzes your telemetry, automatically detects what matters, and surfaces actionable intelligence so your team can spend less time finding problems and more time fixing them.
Nightshift works by:
- Extracting Knowledge Indicators (KIs): Nightshift reads your stream data and extracts stable facts: what services are running, what infrastructure is in use, what technologies are present, and how they relate to each other.
- Generating and running detection rules: Based on KIs, Nightshift generates ES|QL detection rules and runs them continuously. When rule firing patterns change, it detects the change.
- Surfacing Significant Events: When detections correlate into something meaningful, Nightshift promotes a Significant Event — a concise summary of what's happening, with severity, evidence, and suggested next steps.
- Investigating automatically: For each Significant Event, Nightshift triggers an autonomous investigation: it reads your system memory, runs targeted queries, and produces a root cause hypothesis with remediation options.
- Learning over time: The memory system captures knowledge from each incident so future investigations are faster and more precise.
- Enterprise license: Nightshift requires an active Elastic Enterprise license or trial on Elasticsearch Serverless.
- Streams: Your data must be organized in Streams. Nightshift attaches to streams and runs the KI extraction and detection pipeline per stream.
The Nightshift landing page is your central hub for active Significant Events. It shows critical Significant Events detected across your streams, what investigations are running, and what needs your attention.
From your Observability project, navigate to Streams ➡ Significant Events ➡ Nightshift to open the Nightshift UI. Nightshift opens and begins loading Significant Events.
If you don't see any events, Nightshift may still be running its initial KI extraction and rule generation. If your streams have sufficient data, events will surface automatically.
The landing page is divided into two panels:
- Needs action and Resolved: These panels show the count of events that need action and resolved events. Select the panel to go to the list of active or resolved significant events.
- Blast radius: This panel shows the most affected entities. Select an entity to filter results related to it.
Click View all Significant Events to open the full list of Significant Events. Here you can select Significant Events with lower severity ratings and run inspections on them.
Click any event in the Needs action or Resolved list to open the event flyout.
The top of the flyout shows the event title, triage status (Needs action or resolved), investigation status (Investigating or Investigated), timestamp, and a plain-language summary of what Nightshift detected.
The Detections section lists the individual signals that contributed to this Significant Event. Each detection card shows the rule that fired, the change point type (for example, spike or distribution change), the stream it came from, and the detection pattern. Select any detection to open more details.
The Investigations section shows the investigations Nightshift ran for this event.
For more on what investigations produce and how they work, see Investigations.
Every Significant Event has an Open in chat button. Select it to open a conversation with the AI Agent. You can:
- Ask for more detail about what happened and why.
- Request remediation options.
- Ask about affected services or dependencies.
- Explore hypotheses the investigation didn't fully cover.
The AI Agent has access to the event's detections, associated KIs, and memory pages about your system.