Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/elasticsearch-logs
Search and analyse logs in an existing Elasticsearch cluster (8.x/9.x) — syslog, application logs, Zeek/Suricata exports, or any indexed event data.
Passed 15 of 20 test cases with the skill, and 10 of 20 without it.
and 3 more in the full report
6 fixed11 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
When filtering index names with the list_indices tool in this Elasticsearch MCP server, what is the exact parameter key name?
| Checked | Without skill | With skill |
|---|---|---|
| Uses index_pattern as the argument name. | Missed | Passed |
The instructions your model reads when the skill loads.
Read-only log search over an Elasticsearch cluster you already run. NetClaw installs no cluster and indexes nothing — this queries what is already there.
Server: elasticsearch-mcp (adopted, docker.elastic.co/mcp/elasticsearch, Apache-2.0,
digest-pinned) · 5 tools · 1,094 tokens
A bare
searchtotal is capped at 10,000 and reads as if it were exact.
Elasticsearch stops counting at 10,000 and marks the total relation: "gte" — meaning at
least. This server discards that qualifier and prints Total results: 10000. There is
nothing in the response to tell you the number is a floor.
Measured against 10,075 real documents:
| How you ask | What you get |
|---|---|
search with no guard | Total results: 10000 — wrong |
search with "track_total_hits": true | Total results: 10075 — correct |
esql STATS COUNT(*) | 10075 — correct |
On a million-document index a bare search still says 10,000. The error is unbounded and invisible.
Therefore, for any question of the form "how many", "how often", "which is most", or any number a human will act on:
esql with STATS COUNT(*), orsearch with "track_total_hits": true in the query_body.search without that guard is for retrieving example documents only — never for counting.
If you report a total that came from an unguarded search, you are reporting a number that may
be arbitrarily wrong.
| Tool | Use it for | Required arguments |
test cases passed, vs 10 / 20 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.