Kibana MCP Server

Instructions

Implementation Reference

• src/tools/index.ts:306-348 (handler)

  Handler for the 'search_logs' tool in MCP, which processes the request parameters and calls the Kibana client.

  case 'search_logs': {
    const { index, query, size = 10, from = 0, sort } = args as {
      index: string;
      query?: Record<string, unknown>;
      size?: number;
      from?: number;
      sort?: unknown[];
    };
  
    const searchParams = {
      index,
      body: {
        query: query || { match_all: {} },
        size: Math.min(size, 100),
        from,
        ...(sort && { sort }),
      },
    };
  
    const result = await kibanaClient.searchLogs(searchParams);
  
    return {
      content: [
        {
          type: 'text' as const,
          text: JSON.stringify(
            {
              took: result.took,
              total: result.hits.total,
              hits: result.hits.hits.map((hit) => ({
                _id: hit._id,
                _index: hit._index,
                _score: hit._score,
                _source: hit._source,
              })),
            },
            null,
            2
          ),
        },
      ],
    };
  }

• src/kibana/client.ts:221-237 (handler)

  Actual API implementation of searchLogs in the KibanaClient that executes the search request against the Kibana backend.

  async searchLogs(
    params: ElasticsearchSearchParams
  ): Promise<ElasticsearchSearchResponse> {
    // Use Kibana's internal Elasticsearch proxy
    const response = await this.axiosInstance.post(
      `/internal/search/es`,
      {
        params: {
          index: params.index,
          body: params.body || {},
        },
      }
    );
  
    // Kibana wraps the ES response under rawResponse
    return response.data.rawResponse ?? response.data;
  }

• src/tools/index.ts:127-160 (schema)

  Schema registration for the 'search_logs' tool, defining input requirements and descriptions.

    name: 'search_logs',
    description:
      'Search Elasticsearch data through Kibana using Elasticsearch query DSL',
    inputSchema: {
      type: 'object',
      properties: {
        index: {
          type: 'string',
          description: 'Index pattern or name to search',
        },
        query: {
          type: 'object',
          description:
            'Elasticsearch query DSL (e.g., {"match_all": {}} or {"term": {"field": "value"}})',
        },
        size: {
          type: 'number',
          description: 'Number of results to return (default: 10, max: 100)',
          default: 10,
        },
        from: {
          type: 'number',
          description: 'Starting offset for pagination (default: 0)',
          default: 0,
        },
        sort: {
          type: 'array',
          description:
            'Sort specification (e.g., [{"@timestamp": "desc"}])',
        },
      },
      required: ['index'],
    },
  },