Elastic MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| KIBANA_SPACE | No | Kibana space name | default |
| ELASTIC_NODES | Yes | Kibana base URL (e.g., https://kibana.example.com) | |
| CF_ACCESS_TOKEN | No | Cloudflare Access JWT | |
| ALLOWED_SERVICES | No | Comma-separated allowlist of kubernetes.container.name values | |
| ELASTIC_PASSWORD | No | Basic auth password | |
| ELASTIC_USERNAME | No | Basic auth username | |
| ELASTIC_MAX_RESULTS | No | Maximum number of search results | 500 |
| ELASTIC_REQUEST_TIMEOUT | No | Request timeout in milliseconds | 60000 |
| ELASTIC_TLS_REJECT_UNAUTHORIZED | No | Set false for self-signed certificates | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_indicesA | List available indices by searching Kibana data views. Filter by pattern to find specific service logs. |
| list_data_viewsA | List Kibana data views (index patterns). Shows all available log sources with their index patterns and names. |
| get_mappingA | Get field names and types for an index pattern via Kibana. Shows field names, types, and whether they are searchable/aggregatable. |
| search_logsB | Search logs via Kibana with filters and time ranges. Supports service filtering by kubernetes.container.name, free-text queries, and field filters. |
| aggregate_logsA | Run aggregations on logs: terms (top values), date_histogram (trends over time), stats (min/max/avg), count. Supports service filtering. |
| get_documentB | Fetch a single document by its ID. Searches across the given index pattern. |
| cluster_healthB | Check Kibana connectivity and list available data views as a health check. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Most tools have clear, distinct roles, but list_indices, list_data_views, and cluster_health all surface data-view/index information and could be confused during discovery. The remaining search, aggregate, mapping, and document tools are well separated.
The tool names mostly follow a predictable verb_noun pattern: list_*, get_*, search_*, and aggregate_*. cluster_health is the main outlier, since it reads as a noun phrase rather than an imperative action like the others.
Seven tools is a reasonable size for a focused Kibana/Elasticsearch log server. The count is slightly higher than necessary because listing functionality is split across multiple overlapping tools.
The toolset covers the full log-exploration workflow: discover data sources, inspect mappings, search logs, aggregate logs, and fetch individual documents. Health checking is also present, so agents can verify connectivity without hitting a dead end.