elasticsearch

elasticsearch is a skill for Claude Code, Codex from RightNow-AI/openfang. It costs 20 tokens per session (625 once invoked), scanned A, original, Apache-2.0.

A guide to Elasticsearch, a search and analytics engine for finding and aggregating large amounts of data. It covers query construction, field types, indexes, and cluster operation.

In plain words
What is it for?
Building full-text search, exact-match filters, aggregations, log analysis, time-based data indexes, and Elasticsearch cluster queries.
Why use it?
It helps avoid search errors, incompatible field definitions, slow queries, and poorly managed indexes. It also explains how to keep data available during reindexing and monitor cluster health.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Building full-text search, exact-match filters, aggregations, log analysis, time-based data indexes, and Elasticsearch cluster queries.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/rightnow-ai/openfang/elasticsearch
About the project

OpenFang is an open-source operating system for autonomous AI agents, built in Rust to run agents that perform scheduled work such as research, monitoring, lead generation, and reporting. It is for people who want agents to operate continuously rather than only respond to prompts. The catalogue add-ons extend workflows around the OpenFang agent system.

RightNow-AI/openfang · 18,170 stars · on GitHub · openfang.sh

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add RightNow-AI/openfang --skill elasticsearch
Clone the repo
git clone --depth 1 https://github.com/RightNow-AI/openfang

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for elasticsearch

README.md
[![agentmods](https://agentmods.dev/badge/skills/rightnow-ai/openfang/elasticsearch.svg)](https://agentmods.dev/skills/rightnow-ai/openfang/elasticsearch)
Your own site
<a href="https://agentmods.dev/skills/rightnow-ai/openfang/elasticsearch"><img src="https://agentmods.dev/badge/skills/rightnow-ai/openfang/elasticsearch.svg" alt="Measured on agentmods" height="20"></a>
Per session 20 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 625 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00020 $0.00625
Opus 5 $0.00010 $0.00313
Sonnet 5 $0.00004 $0.00125
Haiku 4.5 $0.00002 $0.00063

Measured 9d ago against content hash 09a0b80913c6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

elasticsearch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

2 near-identical copies found in the catalogue:

crates/openfang-skills/bundled/elasticsearch/SKILL.md · 40 lines

How it starts

The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Elasticsearch Expert

A search and analytics specialist with deep expertise in Elasticsearch cluster architecture, query DSL, mapping design, and performance optimization. This skill provides production-grade guidance for building search experiences, log analytics pipelines, and time-series data platforms using the Elastic stack.

Key Principles

  • Design mappings explicitly before indexing data; relying on dynamic mapping leads to field type conflicts and bloated indices
  • Understand the difference between keyword fields (exact match, aggregations, sorting) and text fields (full-text search with analyzers)
  • Use index aliases for zero-downtime reindexing, canary deployments, and time-based index rotation
  • Size shards between 10-50 GB for optimal performance; too many small shards waste overhead, too few large shards limit parallelism
  • Monitor cluster health (green/yellow/red) continuously and investigate yellow status immediately, as it indicates unassigned replica shards

Techniques

  • Construct bool queries with must (scored AND), filter (unscored AND), should (OR with minimum_should_match), and must_not (exclusion) clauses
  • Use match queries for full-text search with analyzer-aware tokenization, and term queries for exact keyword lookups without analysis
  • Build aggregations: terms for top-N cardinality, date_histogram for time bucketing, nested for sub-document analysis, and pipeline aggs like cumulative_sum
  • Apply Index Lifecycle Management (ILM) policies with hot/warm/cold/delete phases to automate rollover and data retention
  • Reindex with POST _reindex using source/dest, applying scripts for field transformations during migration
  • Check cluster allocation with GET _cluster/allocation/explain to diagnose why shards remain unassigned
  • Tune search performance with the search profiler API, request caching, and pre-warming for frequently used queries

Common Patterns

  • Search-as-you-type: Use the search_as_you_type field type or edge_ngram tokenizer with a match_phrase_prefix query for autocomplete experiences
  • Parent-Child Relationships: Use join field types for one-to-many relationships where child documents update independently, avoiding costly nested reindexing
  • Cross-cluster Search: Configure remote clusters and use cluster:index syntax to query across multiple Elasticsearch deployments transparently
  • Snapshot and Restore: Register a snapshot repository (S3, GCS, or filesystem) and schedule regular snapshots for disaster recovery with SLM policies

Read the full file on GitHub · 40 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 40 lines · 20 tokens per session scan A 09a0b80913c6

Subscribe to this mod's changes

elasticsearch is a skill published in the GitHub repository RightNow-AI/openfang (18,170 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 20 tokens to every session and 625 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.