Kibana Streams
Call Kibana Streams REST endpoints to list streams, read definitions, and manage lifecycle with correct space paths and kbn-xsrf headers.
Overview
Kibana-streams is an agent skill most often used in Operate (also Build integrations, Ship launch) that documents Kibana Streams REST paths, parameters, and headers for reading and managing streams.
Install
npx skills add https://github.com/elastic/agent-skills --skill kibana-streamsWhat is this skill?
- Documents base paths for default and Kibana space URLs under /api/streams
- Tables read operations: GET stream list, GET stream by name, queries, significant_events, attachments
- Lifecycle mutations require kbn-xsrf: true header per Elastic API rules
- Links to full Kibana Streams API operation catalog on elastic.co
- In-scope v1 read operations documented in tabular form with Method and Path columns
Adoption & trust: 1.1k installs on skills.sh; 502 GitHub stars; 2/3 security scanners passed (skills.sh audits).
What problem does it solve?
You need to query or manage Kibana Streams via API but keep hitting wrong space URLs or missing kbn-xsrf on lifecycle calls.
Who is it for?
Builders operating Elastic observability who want agent-accurate REST snippets for stream list and detail reads.
Skip if: Greenfield apps with no Elastic deployment or teams only using raw Elasticsearch without Kibana Streams feature.
When should I use this skill?
You are writing or debugging HTTP clients against Kibana Streams list, read, or lifecycle endpoints.
What do I get? / Deliverables
You issue valid Kibana Streams GET and lifecycle requests against the right /api/streams paths for your space.
- Correct REST paths and methods for stream reads
- Header and path-parameter checklist for lifecycle calls
Recommended Skills
Journey fit
Spans multiple journey phases - primary shelf plus alternate fits below.
Streams observability is primary Operate work once telemetry is flowing into Elastic Stack. Monitoring is the canonical shelf for querying and governing log/event streams in Kibana.
Where it fits
List /api/streams after a deploy spike to confirm ingestion routes still exist.
Look up stream name parameters before wiring your service logger to the expected Elastic stream identifier.
GET a single stream definition pre-launch to validate queries and attachments match staging.
How it compares
API cheat-sheet skill for Kibana Streams—not a log shipper installer or Elastic MCP replacement.
Common Questions / FAQ
Who is kibana-streams for?
Solo devs and SRE-lite operators on Elastic Stack who automate stream inspection and lifecycle from Claude Code or similar agents.
When should I use kibana-streams?
In Operate monitoring for stream health; in Build integrations when mapping service logs to streams; in Ship launch when verifying telemetry routes before go-live.
Is kibana-streams safe to install?
The skill describes authenticated API access to your Kibana—check Security Audits on this page and scope API keys to least privilege.
SKILL.md
READMESKILL.md - Kibana Streams
# Kibana Streams API Reference Quick reference for reading stream data and managing stream lifecycle via the Kibana Streams REST API. Lifecycle operations require the `kbn-xsrf: true` header. [Streams API (full operations list)](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-streams) ## Base path Default space: `<kibana_url>/api/streams` Non-default space: `<kibana_url>/s/<space_id>/api/streams` ## Path parameters | Parameter | Used in | Description | | -------------- | -------------------------------------------------------------- | -------------------------------- | | `{name}` | `/api/streams/{name}`, `.../queries`, `.../significant_events` | Stream identifier | | `{streamName}` | `/api/streams/{streamName}/attachments` | Stream identifier (same as name) | Refer to the official operation pages for request/response body schemas. ## In-scope operations (v1) ### Read | Operation | Method | Path | Description | | -------------------------- | ------ | ---------------------------------------- | ---------------------------------------------------- | | Get stream list | GET | `/api/streams` | List all streams | | Get a stream | GET | `/api/streams/{name}` | Get stream definition and metadata | | Get ingest stream settings | GET | `/api/streams/{name}/_ingest` | Get ingest config (stream lifecycle + failure store) | | Get query stream settings | GET | `/api/streams/{name}/_query` | Get query configuration | | Get stream queries | GET | `/api/streams/{name}/queries` | List queries for the stream | | Read significant events | GET | `/api/streams/{name}/significant_events` | Get significant events for the stream | | Get stream attachments | GET | `/api/streams/{streamName}/attachments` | List attachments (dashboards, rules, SLOs) | In ingest settings, **stream retention** is `ingest.lifecycle` (e.g. `dsl.data_retention`); **failure store retention** is `ingest.failure_store.lifecycle`. When users ask to set or update retention, they usually mean the stream's data retention, not the failure store. ### Lifecycle | Operation | Method | Path | Description | | --------------- | ------ | ----------------------- | --------------------------------------------------- | | Disable streams | POST | `/api/streams/_disable` | Disable streams (can lead to data loss — warn user) | | Enable streams | POST | `/api/streams/_enable` | Enable streams | | Resync streams | POST | `/api/streams/_resync` | Resync streams | Disabling streams deletes wired stream data while preserving classic stream data; confirm with the user before calling the disable API. ## Deferred (later version) The following operations are not covered by this skill in v1: | Operation | Method | Path (pattern) | | ----------------------------- | ------ | ----------------------------------------------------------------------- | | Create or update a stream | PUT | `/api/streams/{name}` | | Delete a stream | DELETE | `/api/streams/{name}` | | Fork a stream | POST | `/api/streams/{name}/_fork` | | Update ingest stream settings | PUT | `/api/streams/{name}/_ingest`