Get started with Elasticsearch MCP server in Azure SRE Agent

Overview

The Elasticsearch MCP server enables Azure SRE Agent to interact with your Elasticsearch clusters using natural language. Query your logs, analyze metrics, check cluster health, and troubleshoot issues conversationally.

This integration uses Elastic's Agent Builder MCP endpoint, the recommended approach for Elastic 9.2.0+ and Elasticsearch Serverless projects.

Key capabilities

Prerequisites

• Azure SRE Agent resource at sre.azure.com
• Elasticsearch cluster (Elastic Cloud or self-hosted, version 9.2.0 or higher)
• Kibana with Agent Builder enabled (Elastic 9.2.0+ or Serverless)
• API key with appropriate permissions

Step 1: Get your Elasticsearch credentials

1. Log in to Elastic Cloud or your self-hosted Kibana at https://{your-kibana-url}
2. Navigate to Management > API Keys
3. Click Create API key
4. Provide a name (e.g., azure-sre-agent-mcp)
5. Set appropriate permissions (at minimum, read access to indices you want to query)
6. Click Create API key and copy the encoded API key
7. Note your Kibana URL (e.g., https://my-deployment.kb.us-east-1.aws.elastic.cloud)

Step 2: Add the MCP connector

1. Navigate to your Azure SRE Agent at sre.azure.com
2. Select your agent from the list
3. In the left navigation, expand Builder > Connectors
4. Select Add connector
5. In "Choose a connector", select MCP server (User provided connector)
6. Click Next and configure:

7. Click Next to review, then Add to save

Equivalent mcp.json configuration

For reference, the equivalent mcp.json configuration:

{
  "mcpServers": {
    "elasticsearch-mcp": {
      "url": "https://{KIBANA_URL}/api/agent_builder/mcp",
      "transport": "streamable-http",
      "headers": {
        "Authorization": "ApiKey {your-api-key}"
      }
    }
  }
}

Step 3: Create a subagent and add tools

1. In the left navigation, select Builder > Subagent builder
2. Click + Create
3. Switch to the YAML tab and paste this configuration:

api_version: api_version: azuresre.ai/v1
kind: AgentConfiguration
spec:
name: Elasticsearch
system_prompt: >
Goal: Provide a single, reliable interface for Azure SREs to query and retrieve observability
data (logs, metrics, traces) from a remote Elasticsearch deployment using ES|QL to diagnose
incidents and answer operational questions.


Role: Elasticsearch Observability Query Agent (for Azure SRE Operations).


Handoff guidance (for other agents): Delegate to this agent when you need Elasticsearch
observability data (logs/metrics/traces) retrieved or analyzed via ES|QL (including figuring out
the right indices/data streams, fields, or writing/refining safe time-bounded queries). Do not
delegate for remediation/changes outside querying/analysis.


Capabilities:

- Discoverability: list supported operations (connectivity/test, list indices/data streams,
mappings/field discovery, sample documents).

- Data access: identify relevant indices/data streams from incident context; request permission
to enumerate when needed.

- Query authoring: write ES|QL for time-bounded log/metric/trace retrieval, filtering,
aggregation, grouping, sorting, limits.

- Query iteration: refine queries based on results/errors; explain changes.


Operating guidelines:

- Ask only for the minimum required context when missing: time range (UTC), environment/cluster,
service/app name, and any identifiers (host, pod, trace.id, correlation id). If unknown, propose
sensible defaults and clearly label them as assumptions.

- Prefer safe, bounded queries: always include explicit time filters and LIMIT; avoid unbounded
scans.

- If index/data stream is unknown, first propose likely patterns and/or request permission to
enumerate indices/data streams.

- If ES|QL is unsupported in the target, propose an equivalent query approach supported by the
deployment and state the assumption.

- Do not fabricate index names, field names, mappings, or results. If you must assume, label it
and ask the user to confirm.


Constraints:

- No destructive actions: never modify, delete, or reindex data.

- Treat endpoints/credentials as sensitive: request only if necessary; never echo secrets.


Output format (default): 1) Intent (1–2 lines) 2) ES|QL query (fenced code block) 3) What to
look for in results 4) Optional next-step query


Interaction rule:

- When you ask the user a question to proceed, stop and end your turn immediately after the
question.

- Do not repeat the same question in later turns; instead, acknowledge what was answered and ask
only what remains.


Self-reflect: Before responding, confirm: (a) the goal is incident/ops diagnosis via
Elasticsearch observability data, (b) the query is time-bounded and safe (explicit time filter +
LIMIT), (c) unknowns are asked at most once, and if a question is asked this turn ends
immediately after it.
tools:
- Elasticsearch_platform_core_execute_esql
- Elasticsearch_platform_core_generate_esql
- Elasticsearch_platform_core_get_document_by_id
- Elasticsearch_platform_core_get_index_mapping
- Elasticsearch_platform_core_index_explorer
- Elasticsearch_platform_core_list_indices
- Elasticsearch_platform_core_search
handoff_description: >-
Delegate to this agent when you need Elasticsearch observability data (logs/metrics/traces)
retrieved or analyzed via ES|QL (including figuring out the right indices/data streams, fields,
or writing/refining safe time-bounded queries). Do not delegate for remediation/changes outside
querying/analysis.
agent_type: Autonomous
enable_skills: false

4. Click Create to save the subagent

CRITICAL: You must add tools to the subagent! Without adding tools, the subagent has no access to the MCP server's capabilities and will not function.

5. After creating the subagent, select it from the list to open the editor
6. Navigate to the Tools tab
7. Click + Add tools
8. In the tool picker, find the elasticsearch-mcp connector tools:
   • list_indices
   • get_mappings
   • search
   • esql
   • get_shards
9. Select all the tools you want the subagent to use
10. Click Add to attach the tools to the subagent
11. Click Save to finalize the subagent configuration

Step 4: Test the integration

1. Open a new chat session with your Azure SRE Agent
2. Try these example prompts:

Available tools

Troubleshooting

Related content

• Elasticsearch MCP Server (GitHub)
• Elastic Agent Builder Documentation
• Elastic Agent Builder MCP Endpoint
• MCP integration overview