Limitations and known issues in Elastic Agent Builder

Serverless Elasticsearch Preview Serverless Observability Unavailable Serverless Security Unavailable Stack Preview 9.2.0

Elastic Agent Builder is enabled by default in Elastic Cloud Serverless for Elasticsearch projects.

However, it must be enabled for non-serverless deployments Stack Preview 9.2.0 . Refer to Get started for instructions.

In the first release of Elastic Agent Builder on serverless, the feature is only available on Elasticsearch projects.

While Elastic offers LLM connectors for many different vendors and models, not all LLMs are robust enough to be used with Elastic Agent Builder. We recommend using the Elastic Managed LLM (the default). Learn more in Using different models in Elastic Agent Builder.

The following errors suggest your selected model may not be compatible with Elastic Agent Builder:

Error: Invalid function call syntax
		

Error executing agent: No tool calls found in the response.
		

This error occurs when a conversation exceeds the maximum context length supported by the LLM. This typically happens when tools return large responses that consume the available token budget.

To mitigate this issue, consider the following strategies:

• Optimize queries: Narrow your questions to reduce the scope of data retrieval
• Start a new conversation: Begin a fresh conversation, optionally providing a summary of the previous context
• Refine tool descriptions: Update tool descriptions and agent instructions to guide the agent toward requesting only essential data
• Limit tool response size: Create custom tools that filter or paginate data to return smaller, focused datasets

ES|QL tools are subject to the current limitations of the ES|QL language itself.

For non-serverless deployments, ensure your cluster version supports the ES|QL features you intend to use.

For a complete list of ES|QL limitations, refer to the the ES|QL limitations documentation.

The .execute_esql tool is designed only for ES|QL syntax, not other query languages.

When using SQL syntax with the default agent, it attempts to use the .execute_esql tool instead of recognizing the input as SQL.

This results in parsing errors like this:

[
  {
    "type": "error",
    "data": {
      "message": "parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}",
      "stack": "ResponseError: parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}\n    at KibanaTransport._request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:591:17)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:697:22\n    at KibanaTransport.request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:694:14)"
    }
  }
]
		

On 9.2 deployments, the Copy your MCP server URL button does not include the space name when used from a custom Kibana Space.

Workaround: Manually add /s/<space-name> to the URL. For example: https://<deployment>/s/<space-name>/api/agent_builder/mcp

For more information about Elastic Agent Builder and Spaces, refer to Permissions and access control.