# Kibana MCP for AI Agents AI Agent Connect > Kibana MCP lets you manage your entire Elastic Stack observability environment through your AI agent. You can create spaces, search for specific dashboards or index patterns, and move saved objects between environments without leaving your chat interface. It handles the heavy lifting of manual navigation in Kibana so you can focus on the data. ## Overview - **Category:** data-analytics - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_IUe74WPcRluHtHTsIQFJysYv3KHxYDAuXRm5Mkvf/ai-agent-connect - **Tags:** elastic-stack, dashboards, observability, data-visualization, kibana-api ## Description Connect your Kibana instance to your AI agent to handle your Elastic Stack management and observability workflows through natural language. Imagine you're trying to find a specific dashboard in a massive Kibana instance with hundreds of saved objects. Usually, that means clicking through endless menus or guessing which space it lives in. With this Connector, you just tell your agent what you're looking for. It scans the instance, pulls up the metadata, and gives you the details you need instantly. If you need to move a group of visualizations from a staging space to production, you don't have to do the manual export-import dance anymore. You can just ask your agent to handle the migration. It's part of the Vinkius catalog, which means it fits right into your existing workflow with Claude or Cursor. You get to manage your roles, alerting rules, and connectors just by describing what you want to happen. It turns a manual, click-heavy administrative task into a simple conversation. Instead of wrestling with the UI to set up a new team's environment, you describe the requirements, and the agent handles the provisioning of spaces and default objects. ## Tools ### create_agent_policy Sets up a new policy for an Elastic Agent. This helps manage how your agents interact with your data. ### create_case Generates a new case record. Use this to start tracking a new issue or request. ### delete_short_url Deletes a shortened URL. Use this to manage your shared links. ### disable_rule Turns off an active alerting rule. Use this to silence notifications temporarily. ### get_rule Shows the details of a specific alerting rule. Use this to check the logic of a notification. ### import_saved_objects Uploads saved objects from a file. Use this to bring in dashboards from other instances. ### list_data_views Shows all data views in your instance. Use this to see how your data is mapped. ### list_enrollment_keys Shows all current enrollment keys. Use this to manage new device additions. ### copy_saved_objects Moves saved objects from one Kibana space to another. It makes moving dashboards between environments much easier. ### create_connector Sets up a new connector for data ingestion. This helps bring in new data sources to your stack. ### create_data_view Builds a new data view for easier exploration. This makes it simpler for users to query specific data. ### create_rule Sets up a new alerting rule. Use this to notify your team when specific conditions are met. ### create_runtime_field Adds a new runtime field to a data view. This allows you to create new fields without reindexing data. ### create_saved_object Makes a new saved object like a dashboard. Use this to build out your monitoring visuals. ### create_short_url Generates a shortened URL for easy sharing. This makes it simple to share dashboards with teammates. ### create_space Makes a new workspace for a specific team. This keeps your dashboards organized by department. ### delete_cases Removes old or unnecessary cases. Use this to clean up your active ticket history. ### delete_connector Removes a connector from your setup. Use this to prune old data sources. ### delete_role Removes a Kibana role from the system. Use this to clean up old permission sets. ### delete_rule Deletes an existing alerting rule. Use this to remove old notifications. ### delete_saved_object Removes a specific saved object. This is useful for cleaning up old dashboards. ### delete_space Removes a Kibana space. This helps clear out old team environments. ### enable_rule Turns on an alerting rule. Use this to activate new notifications. ### execute_connector Runs a specific connector action. Use this to trigger data updates manually. ### export_saved_objects Downloads sets of saved objects. This is great for backing up your dashboards. ### find_rules Searches for all current alerting rules. Use this to audit your active notifications. ### find_saved_objects Searches for dashboards and other saved objects. This helps you find specific assets quickly. ### get_agent Shows the details of a specific Elastic Agent. Use this to check the status of a device. ### get_case Shows the details of a specific case. Use this to view the history of a ticket. ### get_connector Shows the details of a specific connector. Use this to check your data ingestion status. ### get_data_view Shows the details of a specific data view. Use this to inspect how your data is organized. ### get_role Shows the details of a specific Kibana role. Use this to see what permissions a role has. ### list_agent_policies Shows all current agent policies. Use this to audit your agent configurations. ### list_agents Shows all Elastic Agents in the system. Use this to see every device in your fleet. ### list_connectors Shows all connectors you have set up. Use this to see all your active data sources. ### list_spaces Shows all available Kibana spaces. Use this to see how your workspace is organized. ### resolve_import_errors Fixes issues that happen during an import. Use this to ensure your dashboard migrations succeed. ### search_cases Searches through your existing cases. Use this to find specific tickets quickly. ### unenroll_agent Removes an Elastic Agent from your setup. Use this to decommission old devices. ### update_cases Modifies details of existing cases. Use this to update the status of a ticket. ### update_data_view Modifies a specific data view. Use this to change how your data is presented. ### update_rule Modifies an existing alerting rule. Use this to change the threshold of a notification. ### update_saved_object Modifies a specific saved object. Use this to change the configuration of a dashboard. ### create_enrollment_key Generates a key to enroll new agents. Use this to quickly add new devices to your fleet. ### create_or_update_role Defines or modifies a Kibana role for permissions. This helps control who can see what in your instance. ### delete_data_view Deletes a specific data view. This helps keep your data exploration area clean. ### get_saved_object Shows the details of a specific saved object. Use this to see the configuration of a dashboard. ### get_short_url Shows the details of a specific short URL. Use this to see where a link points. ### get_space Shows the details of a specific Kibana space. Use this to see the contents of a workspace. ### list_roles Shows all Kibana roles. Use this to see all available permissions in your stack. ### update_space Modifies details of a Kibana space. Use this to rename or reconfigure a workspace. ### add_case_comment Adds a comment to a specific case. This helps keep a history of notes on your active tickets. ### bulk_create_saved_objects Creates multiple saved objects at once. This saves time when setting up new environments. ### bulk_get_saved_objects Retrieves multiple saved objects in a single request. Use this to quickly audit your saved assets. ### bulk_update_saved_objects Updates several saved objects simultaneously. This is the fastest way to apply changes to multiple items. ## Prompt Examples **Prompt:** ``` List all the spaces we have for the engineering team. ``` **Response:** ``` I've checked the Kibana instance. Here are the spaces associated with the engineering team: - **Engineering-Logs** (ID: eng-logs) - **DevOps-Staging** (ID: dev-staging) - **QA-Environment** (ID: qa-env) ``` **Prompt:** ``` I need to find a dashboard about network traffic in the production space. ``` **Response:** ``` Searching for 'network traffic' in the production space... I found 3 dashboards: - **Global Network Traffic Overview** (ID: net-01) - **VPC Flow Logs Analysis** (ID: vpc-02) - **Edge Router Metrics** (ID: edge-03) Would you like the configuration details for any of these? ``` **Prompt:** ``` Can you create a new alerting rule that notifies us if the error rate goes above 5%? ``` **Response:** ``` I've created a new alerting rule for you. - **Rule Name**: High Error Rate Alert - **Condition**: Error rate > 5% - **Status**: Enabled - **Notification**: Sent to the #ops-alerts channel. ``` ## Capabilities ### Create new Kibana spaces Make new workspaces to isolate team data or different environments. ### Search for specific dashboards Find dashboards and index patterns across your instance using natural language. ### Move saved objects Copy dashboards and visualizations between different Kibana spaces. ### Manage alerting rules Create, update, or disable rules to control your notifications. ### Manage Kibana roles Define and update user permissions and roles across your stack. ### Bulk update objects Apply changes to multiple saved objects at once to save time. ## Use Cases ### Migrating dashboards between staging and production An SRE needs to move a set of production-ready dashboards. They ask the agent to use `copy_saved_objects` to move them from the staging space to production. ### Finding specific assets in a large enterprise instance A data analyst can't find a specific index pattern. They ask the agent to use `find_saved_objects` to search for it by name across all spaces. ### Provisioning a new team environment A platform engineer needs to set up a new security team space. They ask the agent to use `create_space` and `create_data_view` to build the environment. ### Silencing or updating alert thresholds During a maintenance window, an engineer asks the agent to use `disable_rule` to turn off noisy alerts, then uses `update_rule` to change thresholds later. ## Benefits - Move dashboards across environments quickly using `copy_saved_objects` to eliminate manual export steps. - Find specific visualizations instantly with `find_saved_objects` instead of clicking through nested folders. - Automate team setup by using `create_space` and `create_saved_object` to provision environments in seconds. - Manage alerting logic without clicking through menus using `create_rule` and `update_rule` to adjust thresholds. - Audit permissions easily with `list_roles` and `create_or_update_role` to keep your stack secure. - Handle bulk updates to your observability stack with `bulk_create_saved_objects` to stay consistent. ## How It Works The bottom line is you get direct, natural language control over your Elastic Stack configuration. 1. Subscribe to the Kibana MCP and provide your URL and API key. 2. Connect it to your preferred AI client like Cursor or Claude. 3. Ask your agent to perform tasks like listing spaces or creating rules. ## Frequently Asked Questions **Can the Kibana MCP help me move dashboards between different spaces?** Yes, it can move dashboards and other saved objects between spaces automatically. You just describe the move to your agent, and it handles the transfer without you needing to export or import files manually. **How do I use the Kibana MCP to find specific index patterns?** You can ask your agent to search for specific index patterns or dashboards across your entire instance. It will scan the metadata and list the ones that match your description. **Can I manage my team's roles using the Kibana MCP?** Yes, you can create, update, or list Kibana roles using natural language. This makes it much easier to manage permissions and see who has access to what in your stack. **Does the Kibana MCP work with my existing Elastic Stack?** It works directly with your existing Kibana instance. You just need to provide the URL and an API key to connect your agent to your current environment. **How does the Kibana MCP handle alerting rules?** The Connector allows your agent to create new rules, update existing ones, or toggle them on and off. You can describe the conditions and notification targets in plain English. **Can I use the Kibana MCP to set up new spaces for different departments?** Absolutely. You can ask your agent to create a new space for a specific department, and it can even provision default data views and roles to get the space ready for use. **How do I use the Kibana MCP to audit my current saved objects?** You can ask your agent to list or search for saved objects. This is a great way to quickly see what dashboards and visualizations are currently active across your entire instance. **Can I search for a specific dashboard across my entire Kibana instance?** Yes. Use the `find_saved_objects` tool and specify the type as 'dashboard'. You can also provide a search string to filter the results by name or description. **Is it possible to move dashboards from a development space to a production space?** Absolutely. The `copy_saved_objects` tool allows you to select objects from a source space and replicate them into one or more target spaces, including their references. **Can I create new Kibana spaces using this integration?** Yes, you can use the `create_space` action. You just need to provide the space configuration JSON, including the ID and name you want for the new environment.