The Problem
Teams working with Elasticsearch face a steep learning curve: the REST API is broad, Query DSL is complex, and aggregations have deep syntax. Most teams either pay that tax repeatedly via tribal knowledge, or bolt on an MCP server that burns context window tokens on tool schemas before work starts. Neither is a good use of an engineer's time or an LLM's context.
What This Does
elasticsearch-skill is a markdown-based skill that teaches Claude Code to interact with Elasticsearch clusters directly via curl. No SDK, no MCP server, no client library — just documentation that the LLM reads and then executes against the REST API. The skill loads SKILL.md as its primary instruction set, covering auth, search, CRUD, bulk operations, index management, cluster health, ILM, ES|QL, and ingest pipelines. Deeper reference files in references/ load only when needed, covering Query DSL, aggregations, mapping, cluster ops, Kibana API, and OpenTelemetry data.
The design choice is deliberate. The README makes a clear argument: MCP servers inject JSON tool schemas into context on every request (Anthropic measured ~55k tokens for a five-server setup), while a skill uses progressive disclosure — main instructions on trigger, reference files only when the LLM actually needs them. The trade-off is real: you lose the structured tool interface, but you gain context efficiency and zero infrastructure to maintain.
How To Use It
Setup — Clone the repo and copy files to a skill directory. Two options documented in the README: personal (~/.claude/skills/elasticsearch/) or project-level (.claude/skills/elasticsearch/). The README explicitly warns that GitHub URLs in settings.json do not work — skills must be local files.
Configuration — Set environment variables before starting Claude Code:
export ESURL="https://your-cluster.es.cloud.elastic.co:443" export ESAPIKEY="your-base64-api-key" export KIBANAURL="https://your-cluster.kb.cloud.elastic.co:443" # optional
Running it — Restart Claude Code and verify with /skills; elasticsearch should appear. No server, no dependencies, no Docker.
Real-World Use
An SRE debugging a search latency spike can ask Claude Code to "check cluster health and show the top 5 slowest queries in the last hour." The skill loads SKILL.md for auth patterns, then pulls references/cluster-api.md for health endpoints and references/aggregations.md for the query patterns. Claude writes and executes the curl calls directly — no tool schema overhead, no translation layer.
Code Health & Issues
Medium — No test files detected — repository-wide. This is documentation, not code, so tests are less critical, but there's no automated way to verify the curl patterns are correct against a real cluster. Medium — No CI/CD pipeline — no .github/ or CI config. No automated check that the markdown renders correctly or that examples match current Elasticsearch API versions. Medium — No LICENSE file — usage and redistribution rights are unclear. The repo is forked from davidgeorgehope/elasticsearch-skill (27 stars), so provenance exists, but the license status is ambiguous. Low — Single maintainer risk — the fork has no visible contributor structure, so API drift (Elasticsearch releases change frequently) is a real concern. The references need active upkeep to stay current.
The Bottom Line
This is a well-argued, pragmatic alternative to MCP for Elasticsearch work. The progressive disclosure design is sound and the README's reasoning about token efficiency is credible. It's best suited for teams already using Claude Code who want Elasticsearch capability without infrastructure overhead — but verify the API examples against your cluster version before relying on them in production, and clarify the licensing before distributing it internally.