Loading

Skills in Elastic Agent Builder

A skill is a reusable instruction set that gives agents specialized expertise for a particular type of task. Instead of embedding the same detailed instructions in every agent that needs them, you author a skill once and assign it wherever it's needed. This keeps agent configurations clean and makes expertise easy to maintain and share across your team.

Tools are discrete operations the agent can invoke. Skills are higher-level capability packs that bundle tools, instructions, and context for a specific task domain. To learn more about tools, refer to Tools.

Skills differ from the agent's base system prompt: the system prompt is always in context, while skills are loaded selectively. An agent can have access to many skills without loading them all into the context window at once.

When an agent receives a message, it selects a skill if it determines that one of the available skills is relevant to the query based on the skill's name and description. If a skill activates, it provides:

  • Knowledge content: domain-specific instructions written in Markdown that tell the agent how to approach the task.
  • Tools: Built-in tools or custom tools that the agent can call while the skill is active.

Use skills when you have domain-specific knowledge or procedures that multiple agents should follow consistently. Some examples:

  • An Elastic Security user asks about a suspicious host. The entity-analytics skill activates and guides the agent through finding the entity, analyzing its risk score, asset criticality, and behavioral history.
  • An Elastic Observability user asks why a service is slow or why an alert fired. The observability.investigation skill activates and diagnoses the issue across APM services and infrastructure.
  • An Elasticsearch user asks how to combine keyword and vector search for a product catalog. The search.hybrid-search skill activates and guides the agent through building a hybrid search solution.

Elastic Agent Builder ships with built-in skills for common task domains. The skills available depend on your solution or serverless project type: some skills are available across all deployments, while others are specific to Elasticsearch, Observability, or Elastic Security. Built-in skills are read-only and cannot be modified or deleted.

For the complete list, refer to Built-in skills reference.

You can extend the built-in catalog with your own custom skills. Custom skills are saved to your skill library, which you can manage from Manage components > Skills. Creating a skill adds it to the library, but it is not available to any agent until you add it from Customize > Skills on that agent. This separation means you can maintain a shared library of skills and choose which ones each agent has access to.

To learn how to create and manage custom skills, refer to Custom skills.

To retrieve all available skills programmatically, use the List skills API endpoint: GET /api/agent_builder/skills. For the full set of skills CRUD operations, refer to Custom skills.