abdullahkhawerabdullahkhawer/devops-skills/skills/kibana-cli/SKILL.md

kibana-cli

Skill8 starsChanged 6 months agoApache-2.0View on GitHub

Perform Kibana operations using the Kibana HTTP API via curl. Use for querying saved objects, dashboards, index patterns, and alerts.

We split this skill into the rules it gives an agent

13 rules. About 0 are common, 8 are distinctive, and 5 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈8
Distinctive · estimate
This author's own choices. Worth a look.
5
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Use the instance and rules below when constructing all Kibana API commands.
line 8
Distinctive:
Update the table below with your Kibana instance URLs and corresponding credential file paths:
line 12
Distinctive:
If the target instance is unclear, ask the user before running any command.
line 19
Very specific:
All API calls use curl with the API key read from the instance's credential file, and always require the kbn-xsrf header:
line 31
Distinctive:
NEVER target any Kibana instance not listed in the instance table above.
line 82
Distinctive:
Update the instance table with your actual Kibana URLs before using this skill.
line 83
Distinctive:
NEVER print, display, log, or store the contents of any credential file.
line 84
Very specific:
Always read the API key inline with $(cat <CREDENTIAL_FILE>) — never hardcode a credential value in a command.
line 85
Very specific:
Always include the kbn-xsrf: true header on every request — Kibana rejects mutating requests without it.
line 86
Very specific:
Always pass -s (silent) to curl and pipe through jq for readable output.
line 87
Distinctive:
NEVER run DELETE operations or bulk deletes without explicit user instruction — these are irreversible.
line 88
Very specific:
If a saved object ID or type is unfamiliar, look it up with _find first before mutating.
line 89
Distinctive:
If the required credential file does not exist, inform the user and stop.
line 90

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Kibana CLI Skill

Use the instance and rules below when constructing all Kibana API commands.

Instances

Update the table below with your Kibana instance URLs and corresponding credential file paths:

Environment	Base URL	Credential File
Production	`https://<your-kibana-prod-url>`	`~/.kibana/prod.token`
Staging	`https://<your-kibana-staging-url>`	`~/.kibana/staging.token`

If the target instance is unclear, ask the user before running any command.

Prerequisites (one-time setup by user)

Generate a Kibana API key for each instance you intend to use and save it to the corresponding credential file (see instance table above). Never print or display credential values. Do not perform these steps yourself.

mkdir -p ~/.kibana && echo "<your-api-key>" > <CREDENTIAL_FILE> && chmod 600 <CREDENTIAL_FILE>

Command Format

All API calls use curl with the API key read from the instance's credential file, and always require the kbn-xsrf header:

curl -s -H "Authorization: ApiKey $(cat <CREDENTIAL_FILE>)" \
  -H "kbn-xsrf: true" \
  "<BASE_URL>/api/<endpoint>" | jq .

Example (production):

curl -s -H "Authorization: ApiKey $(cat ~/.kibana/prod.token)" \
  -H "kbn-xsrf: true" \
  "https://<your-kibana-prod-url>/api/status" | jq .

Available API Endpoints

Read-only (safe, no confirmation needed)

Endpoint	Method	Description
`/api/status`	GET	Check Kibana health/status
`/api/saved_objects/_find?type=<type>`	GET	Find saved objects (dashboards, visualizations, index-patterns)
`/api/saved_objects/<type>/<id>`	GET	Get a specific saved object
`/api/index_patterns/index_pattern/<id>`	GET	Get an index pattern
`/api/alerting/rules/_find`	GET	List alerting rules
`/api/alerting/rule/<id>`	GET	Get a specific alerting rule
`/api/spaces/space`	GET	List Kibana spaces
`/api/data_views`	GET	List data views

Mutating operations (confirm with user before running)

Endpoint	Method	Description
`/api/saved_objects/<type>/<id>`	POST/PUT	Create or update a saved object (dashboard, visualization)
`/api/saved_objects/_import`	POST	Import saved objects from an NDJSON file
`/api/data_views/data_view`	POST	Create a data view
`/api/alerting/rule/<id>`	PUT	Update an alerting rule
`/api/alerting/rule/<id>/_disable` / `_enable`	POST	Enable or disable an alerting rule

Never run — requires explicit human approval

Endpoint	Method	Reason
`/api/saved_objects/<type>/<id>`	DELETE	Irreversible deletion of a dashboard/visualization/index-pattern
`/api/saved_objects/_bulk_delete`	POST	Bulk-deletes saved objects — irreversible
`/api/alerting/rule/<id>`	DELETE	Irreversibly deletes an alerting rule
`/api/spaces/space/<id>`	DELETE	Irreversibly deletes a Kibana space and its contents

Rules

NEVER target any Kibana instance not listed in the instance table above. If a URL references a different host, stop and ask the user to confirm.
Update the instance table with your actual Kibana URLs before using this skill.
NEVER print, display, log, or store the contents of any credential file.
Always read the API key inline with $(cat <CREDENTIAL_FILE>) — never hardcode a credential value in a command.
Always include the kbn-xsrf: true header on every request — Kibana rejects mutating requests without it.
Always pass -s (silent) to curl and pipe through jq for readable output.
NEVER run DELETE operations or bulk deletes without explicit user instruction — these are irreversible.
If a saved object ID or type is unfamiliar, look it up with _find first before mutating.
If the required credential file does not exist, inform the user and stop. Do not attempt to find or guess the credential.

Download now (ZIP)

In this repository54 other files it gives its agents.
- alibabacloud-cliSkill
- ansible-cliSkill
- appdynamics-cliSkill
- argocd-cliSkill
- aws-cliSkill
- aws-cloudwatch-cliSkill
- azure-cliSkill
- bash-lintingSkill
- betterstack-cliSkill
- bitbucket-cliSkill
- chef-cliSkill
- code-reviewSkill
- commit-codeSkill
- create-dockerfileSkill
- create-terraform-helm-upgrade-planSkill
- datadog-cliSkill
- digitalocean-cliSkill
- dockerfile-lintingSkill
- dynatrace-cliSkill
- elasticsearch-cliSkill
- gcp-cliSkill
- github-cliSkill
- gitlab-cliSkill
- go-lintingSkill
- grafana-cliSkill
- grafana-loki-cliSkill
- graylog-cliSkill
- helm-cliSkill
- hetzner-cliSkill
- huaweicloud-cliSkill
- jaeger-cliSkill
- jenkins-cliSkill
- jira-and-confluence-cliSkill
- kubernetes-cliSkill
- loggly-cliSkill
- maintenance-check-aws-eksSkill
- maintenance-create-ticket-on-jiraSkill
- ms-teams-cliSkill
- mysql-cliSkill
- newrelic-cliSkill
- oci-cliSkill
- packer-cliSkill
- papertrail-cliSkill
- postgresql-cliSkill
- prometheus-cliSkill
- python-lintingSkill
- rollbar-cliSkill
- salesforce-cliSkill
- sentry-cliSkill
- slack-cliSkill
- splunk-cliSkill
- terraform-cliSkill
- terraform-lintingSkill
- vault-cliSkill

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free