Elastic Agent Builder glossary

This glossary defines the terms used throughout the Elastic Agent Builder documentation. Definitions describe how each term is used in Elastic Agent Builder. Some terms also exist outside this feature with broader meanings.

Entries are listed alphabetically. Where a term applies to a specific deployment, project type, or product version, an applies_to badge is placed next to it. Terms without a badge follow the page-level applicability.

Tip

For the full list of pre-configured agents, skills, and tools available out of the box, refer to the Elastic Agent Builder built-in agents reference, Elastic Agent Builder built-in skills reference, and Elastic Agent Builder built-in tools reference reference pages.

A


A2A protocol: The Agent2Agent (A2A) Protocol specification for communication between AI agents. Elastic Agent Builder implements A2A so that external clients and other agent frameworks can interact with agents in a standardized way. See Agent-to-Agent (A2A) server in Elastic Agent Builder > Execute A2A protocol (POST).

A2A server: The Elastic Agent Builder endpoint that exposes agents to external A2A clients. Use it to integrate Elastic Agent Builder agents with third-party agent frameworks. See Agent-to-Agent (A2A) server in Elastic Agent Builder.

Agent: A capability that iteratively uses a large language model (LLM), system context, and a set of tools and skills to complete a task. Each agent translates a user's natural language request into a sequence of tool calls and reasoning steps to answer questions, take actions, or support workflows. Elastic Agent Builder ships with built-in agents and lets you create custom agents. See Elastic Agent Builder agents overview > How agents work.

Elastic Agent Builder: Elastic's platform for creating and optimizing context for AI agents that analyze and act over your enterprise data. Elastic Agent Builder combines LLM reasoning with skills, tools, and best practices for context engineering and retrieval, so responses are accurately and efficiently grounded in your data. See Elastic Agent Builder.

Elastic Agent Builder APIs: The REST API surface for working with Elastic Agent Builder programmatically: endpoints for agents, tools, skills, conversations, and token consumption. Elastic Agent Builder APIs are a group within the Kibana HTTP API, served under /api/agent_builder/. See Elastic Agent Builder Kibana APIs overview > Available APIs and the API reference.

Agent Builder execution: The metering unit used to bill Elastic Agent Builder usage. Each completed agent interaction is metered as one or more executions based on input token consumption; interactions that fail to return a response aren't metered. See Monitor usage and costs for Elastic Agent Builder > Execution-based billing.

Agent Chat: The synchronous chat interface for interacting with agents using natural language. Agent Chat is available in standalone mode and sidebar mode, and can also be driven programmatically through the Elastic Agent Builder APIs. See Chat with Elastic Agent Builder agents > Agent Chat GUI.

Agent selector: The dropdown in Agent Chat used to switch between agents, open the agent management view, or create a new agent. See Chat with Elastic Agent Builder agents > Start a chat and select an agent.

agentBuilder feature: The Kibana feature privilege that controls access to Elastic Agent Builder. Assign Read or All to roles. For finer-grained control, pair Read with sub-feature privileges such as Manage agents and Manage tools. See Permissions and access control in Elastic Agent Builder > Kibana privileges.

ai.agent step: A workflow step type that invokes an Elastic Agent Builder agent as a reasoning engine within a workflow. Use it to summarize data, classify events, or make decisions in the middle of an automation. See Call Elastic Agent Builder agents from Elastic Workflows > Use the ai.agent step.

AI Agent button: The button in the Kibana top header that opens sidebar mode so you can chat with an agent from any page. See Chat UI modes in Elastic Agent Builder > Sidebar mode.

API key: A credential used for programmatic access to Elastic Agent Builder APIs, including the MCP server and A2A server endpoints. The API key inherits the privileges of the user who created it. See Permissions and access control in Elastic Agent Builder > Grant access with API keys.

Attachment: Data or context added to a chat message, such as an alert flyout, a Kibana object, or a file. Attachments can trigger an agent to invoke the skill most relevant to the attachment type. See Chat with Elastic Agent Builder agents > Agent Chat GUI.

B


Built-in agent: An agent pre-configured by Elastic with default instructions and tools for common use cases. See Elastic Agent Builder built-in agents reference > Elastic AI Agent.

Built-in skill: A read-only skill shipped with Elastic Agent Builder. Built-in skills span platform, Elastic Observability, Elastic Security, and Elasticsearch domains. See Elastic Agent Builder built-in skills reference.

Built-in tool: A read-only tool shipped with Elastic Agent Builder, providing core capabilities such as searching Elasticsearch, executing ES|QL queries, retrieving documents, and listing indices. Built-in tools cover platform, Elastic Observability, and Elastic Security domains. See Elastic Agent Builder built-in tools reference > Platform core tools.

C


Chat history: See Elastic Agent Builder glossary.

Connector: A Kibana integration that enables Elastic Agent Builder to communicate with an external service. See Connectors in Elastic Agent Builder > How agents use connectors.

Context window: The maximum amount of text, measured in tokens, that an LLM can process in a single interaction. When a conversation, tool response, or system prompt grows too large, the agent can encounter a context length exceeded error. See Monitor usage and costs for Elastic Agent Builder > Token usage.

Context length exceeded: An error returned when a conversation has consumed more tokens than the LLM's context window allows, typically because tool responses or chat history have grown very large. See Context length exceeded in Elastic Agent Builder conversations.

Conversation: A single exchange or thread between a user and an agent in Agent Chat. Conversations preserve message history, agent identity, and any attachments used. See Chat with Elastic Agent Builder agents > Agent Chat GUI.

Conversation history: The persisted record of previous conversations between a user and the agents they've used. Shown in the chat history panel and shared across standalone mode and sidebar mode. See Chat with Elastic Agent Builder agents > Find conversation history.

Custom agent: An agent you create with your own system prompt, tools, skills, and visibility settings. Custom agents are space-aware and exist only in the Kibana space where they were created. See Create and manage custom agents in Elastic Agent Builder > Create a custom agent.

Custom instructions: Free-form Markdown that you add to an agent's system prompt to define its persona, scope, tone, or workflow constraints. Custom instructions are always loaded into the context window. See Create and manage custom agents in Elastic Agent Builder > Create a custom agent.

Custom skill: A reusable instruction set you author yourself, bundling domain-specific guidance, tools, and reference content. Custom skills are saved in the skill library and can be assigned to any custom agent. See Create and manage custom skills > Create a custom skill.

Custom tool: A user-defined tool that extends the built-in catalog. Custom tools can be one of four types: ES|QL tool, index search tool, MCP tool, or workflow tool. See Create and manage custom tools in Elastic Agent Builder > Tool types.

Customize accordion: The expandable section in the standalone-mode left sidebar that groups the agent-scoped configuration pages: Overview, Skills, Plugins, and Tools. See Chat UI modes in Elastic Agent Builder > Sidebar mode.

D


Default agent: The Elastic AI Agent, which is automatically created in each Kibana space and acts as the starting agent for new conversations. See Elastic Agent Builder built-in agents reference > Elastic AI Agent.

Default model: The LLM that Elastic Agent Builder uses for any agent that doesn't explicitly select a different one. Configure it from GenAI Settings. See Model configuration in Elastic Agent Builder > Default model configuration.

E


Elastic AI Agent: The general-purpose default agent shipped with Elastic Agent Builder. See Elastic Agent Builder built-in agents reference > Elastic AI Agent.

Elastic Inference Service (EIS): Elastic's managed service for running LLMs on Elastic infrastructure, used by Elastic Managed LLMs. See Model configuration in Elastic Agent Builder > Default model configuration.

Elastic Managed LLM: A pre-configured LLM provided by Elastic and powered by the Elastic Inference Service. On Elastic Cloud Hosted and Elastic Cloud Serverless, an Elastic Managed LLM is available out of the box, so Elastic Agent Builder works with no additional connector setup. See Model configuration in Elastic Agent Builder > Default model configuration.

Enable Elastic Capabilities: The toggle on a custom agent's Settings tab that opts the agent in to all current and future Elastic-built skills, plugins, and tools. The toggle is off by default. See Create and manage custom agents in Elastic Agent Builder > Enable Elastic Capabilities.

Entity store: The Elastic Security store of security entities (hosts, users, services). Elastic Agent Builder security tools and skills can query the entity store to support investigations. See Elastic Agent Builder built-in skills reference > Security skills.

ES|QL tool: A type of custom tool that runs a parameterized ES|QL query directly against Elasticsearch. Use ES|QL tools when you want precise, repeatable retrieval logic that an agent can invoke by name. See ES|QL tools in Elastic Agent Builder > When to use ES|QL tools.

F


Flyout mode: Earlier name for sidebar mode. The two terms refer to the same chat panel; sidebar mode is the current name used in the documentation. See Chat UI modes in Elastic Agent Builder > Sidebar mode.

G


GenAI Settings: The Kibana settings page where you configure the default model and other generative-AI options that affect Elastic Agent Builder. See Model configuration in Elastic Agent Builder > Change the default model.

I


Index search tool: A type of custom tool that performs natural-language search over a configured set of indices, aliases, or data streams. The tool selects an appropriate query strategy (keyword, semantic, or hybrid) automatically. See Index search tools in Elastic Agent Builder > When to use index search tools.

Inline tool: A tool that's available only in a specific context. For example, while a particular built-in skill is active or while an attachment is present in the conversation. Inline tools don't appear in the global tools list. See Tools in Elastic Agent Builder > How agents use tools.

Input tokens: The tokens sent to the LLM in a request, including the user's message, the system prompt, accumulated conversation history, and tool responses. See Monitor usage and costs for Elastic Agent Builder > Token usage.

K


kibana.request step: A generic Workflows step. When ai.agent doesn't cover a scenario, you can use kibana.request to call Elastic Agent Builder APIs from a workflow. See Kibana action steps > kibana.request.

M


Manage components: The link at the bottom of the standalone-mode left sidebar that opens the deployment-wide view of all agents, skills, plugins, connectors, and tools. See Chat with Elastic Agent Builder agents > Manage components.

MCP: The Model Context Protocol, an open standard for connecting AI assistants to external tools and data sources. Elastic Agent Builder both exposes tools through an MCP server and consumes tools from remote MCP servers as MCP tools. See Elastic Agent Builder MCP server > MCP server endpoint.

MCP connector: A Kibana connector that points Elastic Agent Builder at a remote MCP server so its tools can be imported as MCP tools. See Connectors in Elastic Agent Builder > Add a connector.

MCP server: An endpoint that implements the Model Context Protocol. Elastic Agent Builder both exposes its own MCP server, making Elastic tools and agents available to external MCP clients such as Claude Desktop, Cursor, VS Code, or LangChain apps, and consumes remote MCP servers through MCP connectors. See Elastic Agent Builder MCP server > MCP server endpoint.

MCP tool: A type of custom tool that proxies a tool exposed by a remote MCP server. Use MCP tools to give your agents access to capabilities provided by external services. See Model Context Protocol (MCP) tools in Elastic Agent Builder > Adding MCP tools.

Model: The LLM that an agent uses to reason and produce responses. Models are accessed through Elastic Managed LLMs or through GenAI connectors. See Model configuration in Elastic Agent Builder > Default model configuration.

Model selector: The dropdown in Agent Chat used to switch the LLM that the current agent calls. See Model configuration in Elastic Agent Builder > Switch models in the UI.

monitor_inference: The Elasticsearch cluster privilege required when an agent uses an AI connector that calls the Elasticsearch Inference API. Built-in tools such as search and generate_esql, and all index search tools, depend on this privilege. See Permissions and access control in Elastic Agent Builder > Elasticsearch cluster privileges.

O


Output tokens: The tokens generated by the LLM in a response, including the final answer shown to the user as well as any internal reasoning steps and tool-call payloads. See Monitor usage and costs for Elastic Agent Builder > Token usage.

P


Plugin: A reusable bundle of skills and supporting capabilities that can be assigned to an agent as a single unit. Plugins make it easier to share groups of related skills across agents. See Plugins in Elastic Agent Builder > Install a plugin.

Prompt engineering: The practice of writing instructions, examples, and constraints that steer LLM behavior. Elastic Agent Builder provides guidance for shaping agent system prompts, custom instructions, and skill instructions. See Best practices for prompt engineering in Elastic Agent Builder > Core principles.

R


Reasoning: The iterative process an agent follows to answer a request: analyzing the input, choosing tools, executing them, and incorporating results into a response. Each iteration is a reasoning step. See Elastic Agent Builder agents overview > How agents work.

Reasoning panel: The expandable section of the chat reply that shows the underlying reasoning steps, tool calls, and tool responses behind an agent's answer. See Chat with Elastic Agent Builder agents > Inspect tool calls and reasoning.

REST API: See Elastic Agent Builder APIs.

Retrieval-Augmented Generation (RAG): Retrieval-augmented generation is a technique for improving language model responses by grounding the model with additional, verifiable sources of information. It works by first retrieving relevant context from a datastore, which is then added to the model's context window. Elastic Agent Builder agents use Elasticsearch as the retrieval layer, which makes the platform a natural fit for RAG applications. See RAG.

S


Sidebar mode: The chat experience that opens as a persistent panel beside the page you're on, so you can chat with an agent without leaving your current Kibana workflow. Open it from the AI Agent button or with cmd+; / ctrl+;. See Chat UI modes in Elastic Agent Builder > Sidebar mode.

Skill: A reusable capability pack that gives an agent specialized expertise for a particular type of task. A skill bundles instructions, tools, and reference content, and loads selectively based on the user's request. Skills sit one level above tools: a tool performs an operation, a skill teaches the agent how and when to use it. See Skills in Elastic Agent Builder > How skills are invoked.

Skill library: The deployment-wide collection of custom skills. Any custom agent can pull skills from the library. Built-in skills appear alongside them as read-only entries. See Create and manage custom skills > Create a custom skill.

Slash command: The chat shortcut for explicitly invoking a skill. Type / followed by the skill name to bypass automatic skill selection. See Skills in Elastic Agent Builder > How skills are invoked.

Solution view: A Kibana space navigation mode oriented around a single solution (Elasticsearch, Elastic Observability, or Elastic Security). In Elastic Stack deployments on version 8.16 and later, each space has its own navigation, called solution view. The solution view determines which Elastic Agent Builder entry points and built-in capabilities are surfaced. See Get started with Elastic Agent Builder > Access Elastic Agent Builder.

Space: A Kibana space. Custom agents and custom tools are space-aware: they exist only in the space where they were created. The Elastic AI Agent is also space-aware. See Spaces and Permissions and access control in Elastic Agent Builder > Working with spaces.

Standalone mode: The full-page Agent Chat experience, opened from Agents in the main navigation. Standalone mode is recommended when you're working with dashboards, visualizations, or long agent replies. See Chat UI modes in Elastic Agent Builder > Standalone mode.

System prompt: The instructions that are always present in the context window. The system prompt defines an agent's core behavior. Custom instructions are layered on top of it. See Best practices for prompt engineering in Elastic Agent Builder > How agents process prompts.

T


Token: The unit of text that an LLM processes. Token counts roughly correspond to fragments of words and determine how much of the context window a message consumes, as well as the cost of a request. See Monitor usage and costs for Elastic Agent Builder > Token usage.

Tool: A modular function an agent can call to search, retrieve, or manipulate Elasticsearch data. Tools are the primary mechanism for grounding agent capabilities in your data. Elastic Agent Builder provides built-in tools; you can also create custom tools of four types: ES|QL, index search, MCP, and workflow. See Tools in Elastic Agent Builder > How agents use tools.

V


Visibility: A custom agent's sharing setting that controls who can see and edit it. Options are Public (anyone in the space), Shared (anyone can view; only owners and admins can edit), and Private (only owners and admins). See Create and manage custom agents in Elastic Agent Builder > Visibility settings.

W


Workflow tool: A type of custom tool that lets an agent trigger a workflow from a conversation and use its output. See Workflows and Workflow tools in Elastic Agent Builder > Add a Workflow tool.

Workflows: Elastic's native automation engine for declarative, event-driven automation defined in YAML. Elastic Agent Builder integrates with workflows in two directions: agents can trigger workflows through workflow tools, and workflows can call agents through the ai.agent and kibana.request steps. See Call Elastic Agent Builder agents from Elastic Workflows > Approaches.