Limitations and known issues in Elastic Agent Builder

This section lists the limitations and known issues in Elastic Agent Builder.

Index search tools do not automatically discover or search indices on remote clusters. However, agents can query remote clusters using ES|QL if you explicitly instruct the agent to do so.

To enable cross-cluster queries, add instructions to your custom agent or include them in your chat prompt. For example, you could instruct the agent to query remote_cluster:index_name when searching for data that resides on a remote cluster. To learn more, refer to cross-cluster search (CCS).

Elastic Agent Builder does not support cross-project search. Agents can only search data within the current project.

The A2A server does not currently support streaming operations. All agent interactions use the synchronous message/send method, which returns a complete response only after task execution completes.

ES|QL tools are subject to the current limitations of the ES|QL language.

Ensure your cluster version supports the ES|QL features you intend to use.

For a complete list of ES|QL limitations, refer to the ES|QL limitations documentation.

The following errors suggest your selected model may not be compatible with Elastic Agent Builder:

Error: Invalid function call syntax
		

Error executing agent: No tool calls found in the response.
		

To learn more, refer to Model configuration in Elastic Agent Builder.

Current testing shows that Claude 4.6 Sonnet may generate invalid ES|QL for dashboard and visualization workflows, particularly with reserved keywords, dotted field names such as system.load.1, and incorrectly formatted aliases.

Workaround: Use a higher-tier model, such as Claude 4.6 Opus, for ES|QL-heavy dashboard generation. To learn more, refer to Recommended models.

This error occurs when a conversation exceeds the maximum context length supported by the LLM. This typically happens when tools return large responses that consume the available token budget.

To learn more, refer to Context length exceeded in Elastic Agent Builder conversations.

The .execute_esql tool is designed only for ES|QL syntax, not other query languages.

When using SQL syntax with the default agent, it attempts to use the .execute_esql tool instead of recognizing the input as SQL.

This results in parsing errors like this:

[
  {
    "type": "error",
    "data": {
      "message": "parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}",
      "stack": "ResponseError: parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}\n    at KibanaTransport._request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:591:17)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:697:22\n    at KibanaTransport.request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:694:14)"
    }
  }
]
		

On 9.2 deployments, the Copy your MCP server URL button does not include the space name when used from a custom Kibana Space.

Workaround: Manually add /s/<space-name> to the URL. For example: https://<deployment>/s/<space-name>/api/agent_builder/mcp

For more information about Elastic Agent Builder and Spaces, refer to Permissions and access control.

• Get started
• Troubleshooting