/kibana-context-engine

name: kibana-context-engine
description: >
  Query Elastic Context Engine AI Indices, and the Knowledge Indicators (KIs) they
  store. Use when asked to search, explore, count, or answer questions from an AI
  Index / KI / Context Engine knowledge index, and when writing the ES|QL that queries
  one.
metadata:
  author: elastic
  version: 0.2.1
  universal: false
compatibility: Kibana 9.6 or later with matching Elasticsearch, or an Elastic Serverless
  project, with the `contextEngine:enabled` advanced setting turned on in the target
  space. Runs against the Context Engine HTTP APIs through the `elastic` CLI. The
  caller needs Context Engine `read`, plus Elasticsearch `read` and `view_index_metadata`
  on the backing `ai-index-*` indices.

Query Context Engine AI Indices

<!-- begin-partial: preamble -->

Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the [`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`, `GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document maps each shorthand to the equivalent `elastic` CLI command — always use the CLI rather than calling the HTTP API directly.

<!-- end-partial: preamble -->

Concepts

**AI Index** — an Elasticsearch index named `ai-index-idx-*`, or a data stream named `ai-index-ds-*`, registered with the Context Engine under a logical id. The registration lives in Kibana; the knowledge lives in the backing index. Only the list operation knows which `ai-index-*` indices are registered and what to put in `FROM`; the index name alone does not tell you.

**Knowledge Indicator (KI)** — one document in an AI Index: context prepared for agents, such as a description of some data, a summary, an access pattern, a runnable query, or a record of a Kibana resource. A KI may answer a question outright, or help you locate and use the source that does.

A KI is retired by a tombstone (`governance.lifecycle.status: deleted`) or by an `expires_at` in the past. On a data stream, one KI is several revisions under the same `id`, the newest of which is its current state. The query API returns only current, active, unexpired KIs unless the query asks otherwise (see [Lifecycle](#lifecycle)).

Search the AI Indices before broader retrieval whenever their KIs may cover the question. This skill reads KIs; generating them belongs to the Context Engine's automations and feedback loop.

Three read-only Context Engine HTTP APIs back this skill. The [Operations](#operations) table maps each to its `elastic` CLI command:

| Operation | HTTP API (shorthand) | Input | Returns | | --------- | ------------------------------------------------------------ | ---------------------------- | ----------------------------------------------------------------------- | | List | `GET kbn:/api/context_engine/ai_index` | — | `{ ai_indices: [{ id, description, managed, dest: { type, value } }] }` | | Describe | `GET kbn:/api/context_engine/ai_index/{aiIndexId}/_describe` | `aiIndexId` in the path | `{ response }`, a free-form context block (fields, counts, examples) | | Query | `POST kbn:/api/context_engine/ai_index/_query` | `{ query, params?, limit? }` | `{ columns, values }`, ES\|QL rows |

Use them in this order: **list → describe → query**. Never guess an index id, a `FROM` target, or a field name; describe supplies all three. Nothing else can read an AI Index correctly: a generic ES|QL query (`POST /_query`) or index listing neither knows which indices are registered nor applies the space scoping.

Every call is scoped to one space, and the space comes from the request rather than from anything written into the query. Point the request at another space to read that space's KIs.

The canonical KI schema

Elastic's canonical KI indices share these fields. Other AI Indices differ, so treat this as a starting shape and let describe settle the fields for any given index.

| Field | ES\|QL type | Purpose | | -------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------- | | `type` | keyword | Categorization, e.g. `"index_metadata"`, `"document"`, `"entity_profile"`, `"detection"` | | `title` | text | Short name of the KI or its backing entity | | `description` | text | Short description of this KI | | `content` | text | Full text: purpose, questions answered, access patterns | | `tags` | keyword | Filter facets; multi-valued, so use `MATCH(tags, ?tag)` rather than `==` | | `attributes` | flattened | Structured keyword-queryable metadata (status, themes, entity names). `attributes.esql` holds runnable ES\|QL | | `expires_at` | date | Optional; a KI whose `expires_at` has passed is expired and hidden by default