Skip to main content
Glama
ePotok22

kibana-console-mcp

by ePotok22

Search

es_search

Execute Elasticsearch Query DSL searches against Kibana indices to retrieve and analyze log documents. Specify query, aggregations, sort, and selected fields to control the response.

Instructions

Run an Elasticsearch Query DSL search. Pass the query body as an object. Keep "size" small and pass "source" (aliased as "_source") to select fields — log documents are large and oversized responses get truncated.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
aggsNoAggregations clause
fromNoOffset for pagination
sizeNoNumber of hits to return
sortNoSort clause, e.g. [{"@timestamp": "desc"}]
indexYesIndex or pattern to search
queryNoQuery DSL "query" clause, e.g. {"match": {"message": "timeout"}}
sourceNoFields to return, sent as Elasticsearch "_source". Strongly recommended.
_sourceNoAlias for "source", accepted because Elasticsearch itself spells it this way.
track_total_hitsNoSet true for an exact total hit count instead of a 10000 cap

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv0.1.0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It discloses that responses get truncated when oversized, that logs are large, and that field selection via source is strongly recommended. It does not disclose pagination limits (e.g., default max 10000 hits) or what happens on query errors, but the truncation warning is meaningful and directly applicable to agent behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The most important operational guidance is front-loaded: pass query body as object, keep size small, use source. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameter-rich tool with no output schema and no annotations, the description addresses the most critical operational risks: large documents, truncation, and field selection. It is slightly limited by not covering pagination beyond size, total hits, or error behavior, but for an Elasticsearch query tool it provides enough for an agent to invoke it correctly in typical cases. The 100% schema coverage compensates for many missing details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds a few behavioral notes: 'source' is aliased as '_source', and the 'size' guidance is reinforced. But it doesn't explain how aggregations, sort, or track_total_hits interact with the truncation warning or how to combine them with the query clause. The description does not go beyond what the schema descriptions already provide for most parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Run'), a resource ('an Elasticsearch Query DSL search'), and the essence of how to invoke it (pass the query body as an object). It also adds concrete guidance to distinguish the tool's behavior: it targets log documents that are large and may be truncated. This is more than enough to differentiate it from siblings like es_count, es_esql, or es_request.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit invocation guidance: pass the query body as an object, keep size small, and use source/_source to select fields. It also explains the rationale (large log documents, oversized responses get truncated), which helps the agent decide when to use this tool vs alternatives. It doesn't name alternative siblings explicitly, but the context is clear and practical.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ePotok22/kibana-console-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server