Observability ES Client Usage Report — Kibana audit of which apps use which Elasticsearch client abstractions

session-2026-02-19-observability-es-clients.md

Session — 2026-02-19

Summary

Audited all Elasticsearch client usage across x-pack/solutions/observability/ in Kibana. Produced a comprehensive report showing which observability apps use which ES client abstractions (direct ElasticsearchClient, custom wrappers, IScopedClusterClient) and where the key client factories/types are defined.

---

Request: Find all ES client imports in observability and report which apps use which clients

Approach

• Searched for imports of @elastic/elasticsearch, ElasticsearchClient, IScopedClusterClient, and ClusterClient across x-pack/solutions/observability/.
• Searched for custom wrapper patterns: createApmEventClient, createInternalEsClient, createProfilingEsClient, createObservabilityAIAssistantAppEsClient, getTypedSearch, unwrapEsResponse.
• Read key client factory files to understand abstraction layers.

Key files examined

• plugins/apm_data_access/server/lib/helpers/create_es_client/create_apm_event_client/index.ts — APMEventClient factory
• plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts — APMInternalESClient
• plugins/apm/server/utils/create_typed_es_client.ts — TypedSearch wrapper
• plugins/apm/server/lib/apm_telemetry/telemetry_client.ts — TelemetryClient
• plugins/profiling_data_access/common/profiling_es_client.ts — ProfilingESClient interface
• plugins/profiling_data_access/server/utils/create_profiling_es_client.ts — ProfilingESClient factory
• plugins/profiling/server/utils/create_profiling_es_client.ts — Older ProfilingESClient factory
• plugins/observability_ai_assistant_app/server/clients/elasticsearch/index.ts — ObservabilityAIAssistantElasticsearchClient
• plugins/observability_ai_assistant_app/server/clients/create_observability_ai_assistant_app_es_client.ts — Traced ES client
• plugins/observability_agent_builder/server/utils/get_typed_search.ts — Agent Builder typed search
• plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts — Infra KibanaFramework
• plugins/metrics_data_access/server/lib/adapters/framework/kibana_framework_adapter.ts — Metrics KibanaFramework
• plugins/synthetics/server/lib.ts — Synthetics ES client wrapper
• plugins/uptime/server/legacy_uptime/lib/lib.ts — Uptime ES client wrapper
• plugins/observability/server/lib/annotations/create_annotations_client.ts — Annotations client
• plugins/slo/server/services/get_diagnosis.ts — SLO direct ElasticsearchClient usage

Findings

App/Plugin	Direct ElasticsearchClient	Custom Wrapper Client	IScopedClusterClient
APM	Yes (admin ops)	APMEventClient, APMInternalESClient, TypedSearch, TelemetryClient	No
APM Data Access	Yes	APMEventClient (factory)	No
SLO	Primary method	None	Yes
Infra	Yes (alerting, routes)	KibanaFramework	No
Metrics Data Access	Yes	KibanaFramework	No
Synthetics	Yes	UptimeEsClient-style lib	No
Uptime	Yes	UptimeEsClient-style lib	No
Profiling	Yes	ProfilingESClient	No
Profiling Data Access	Yes	ProfilingESClient	Yes
Observability (core)	Primary method	Annotations client	No
Obs AI Assistant App	Yes	ObservabilityAIAssistantElasticsearchClient, Traced ES Client	No
Obs Agent Builder	No	getTypedSearch	Primary method
Obs Onboarding	Primary method	None	No

Key takeaways

• No plugin creates a raw @elastic/elasticsearch Client directly — all go through Kibana's ElasticsearchClient.
• APM has the most elaborate wrapper hierarchy (event routing, tier filtering, debug/inspect, unwrap).
• SLO is the simplest — bare ElasticsearchClient everywhere.
• Profiling has a domain-specific client wrapping esClient.transport.request for private _profiling/* endpoints.
• Infra and Metrics Data Access share a nearly identical legacy KibanaFramework adapter.
• Agent Builder consistently uses IScopedClusterClient → asCurrentUser → getTypedSearch.