security_onion_elasticsearch_skill_claude_code.md

security_onion_elasticsearch_skill_claude_code.md

Perfect! I've successfully gathered all the research materials for creating your Elasticsearch debugging skill. Here's what I created:

📁 Research Directory Created: elasticsearch-research/

Complete Structure (23 files total):

elasticsearch-research/ ├── README.md # Complete guide ├── scripts/ # 9 ES management scripts │ ├── so-elasticsearch-troubleshoot # Primary diagnostic tool │ ├── so-elasticsearch-query # API wrapper │ ├── so-elasticsearch-retention-estimate # Capacity planning │ ├── so-elasticsearch-indices-growth # Growth tracking │ └── ... (5 more scripts) ├── config/ # 3 configuration files │ ├── defaults-excerpt.yaml # Watermark thresholds │ ├── elasticsearch-yaml-structure.md # Config documentation │ └── curl-config-template.md # Auth patterns ├── workflows/ # 5 troubleshooting guides │ ├── disk-watermark-breach.md # Most common issue │ ├── unassigned-shards.md # Critical failures │ ├── ilm-troubleshooting.md # Retention issues │ ├── health-report-analysis.md # Cluster health │ └── retention-planning.md # Capacity planning ├── api-reference/ # 2 API guides │ ├── common-api-endpoints.md # ES API reference │ └── curl-patterns.md # Authentication patterns └── reference/ # 3 reference files ├── file-locations.md # All file paths ├── common-error-patterns.md # Error meanings └── so-common-functions.md # Bash functions

🎯 What's Covered

Workflows (Most important for the skill):

• ✅ Disk watermark breaches (80%/85%/90% thresholds)
• ✅ Unassigned shard troubleshooting
• ✅ ILM policy debugging
• ✅ Health report interpretation
• ✅ Retention planning and capacity management

Tools Referenced:

• 9 critical SO Elasticsearch scripts with full source code
• API endpoints with examples
• Configuration structure and defaults

Documentation:

• Error patterns and their meanings
• File locations and paths
• Common functions from so-common library

🚀 Next Step: Create the Skill

Run this command to create your skill:

/meta-claude:skill:create elasticsearch-troubleshoot ./elasticsearch-research ./skills

This will:

1. Analyze all 23 research files
2. Synthesize an interactive troubleshooting guide
3. Generate a SKILL.md file with decision tree approach
4. Save to ./skills/elasticsearch-troubleshoot/

💡 Skill Design

The skill will provide:

Interactive Decision Tree: What issue are you experiencing?

1. Cluster health is yellow or red
2. Running out of disk space
3. Indices not deleting
4. Performance degradation
5. General diagnostic check

Each path includes:

• Detection commands (sudo so-elasticsearch-troubleshoot)
• Output interpretation (what to look for)
• Step-by-step resolution
• Verification steps

📋 Quick Start

1. Review the materials (optional but recommended): cat elasticsearch-research/README.md
2. Create the skill: /meta-claude:skill:create elasticsearch-troubleshoot ./elasticsearch-research ./skills
3. Test it: /elasticsearch-troubleshoot

🎓 Key Highlights

• Focuses on quick diagnostics (80% of common issues)
• Uses existing SO tools (not raw API calls)
• Step-by-step workflows for each issue type
• Based on real script analysis (9 actual SO scripts)
• Security Onion 2.4 specific (version 8.18.8 ES)

Everything is ready! The research directory contains comprehensive materials for creating a practical, usable Elasticsearch debugging skill. Check out elasticsearch-research/README.md for detailed guidance on creating and using the skill.