Elastic has announced the launch of a new agent-based Kubernetes investigation workflow, alongside observability skills based on the Model Context Protocol. This capability automatically initiates fault diagnosis when an alert is triggered, so that when a site reliability engineer (SRE) opens an alert, root cause analysis, an evidence chain, and remediation suggestions are already prepared.
For teams operating Kubernetes at scale, the time gap between receiving an alert and finding the answer not only prolongs outage duration and worsens service disruption impact, but also exhausts on-call engineers. Elastic effectively bridges this gap by automatically starting the investigation process, beginning its work before an engineer is even paged.
This new capability builds upon Elastic's existing Kubernetes dashboards, pre-built alert templates, and machine learning-powered anomaly detection. It offers two ways to accelerate troubleshooting: an intelligent investigation workflow that automatically runs diagnostics when an alert is triggered, and the integration of the same investigative capabilities into the AI tools and integrated development environments engineers use daily, such as Claude, Cursor, and VS Code.
With the Elastic Observability MCP application, SREs can investigate their Kubernetes environments conversationally. An AI agent can query log and metric data from Elasticsearch in real-time, presenting interactive views directly within the tool. These include cluster health summaries, service dependency graphs, anomaly details, blast radius analysis for end-user failures, and alert rule management. Elasticsearch, with a storage efficiency 2.5 times higher than comparable products, ensures engineers have access to the full operational context when investigating an incident.
Bahaaldine Azarmi, General Manager of Elastic Observability, stated, "An engineer woken up at 3 a.m. doesn't want to start an investigation from scratch; they want answers. With this release, Elastic starts the investigation process the moment an alert fires, enabling teams to resolve issues faster and with more confidence. And because it runs inside the tools engineers already use, there's no context switching and no new interface to learn."
Elastic's Kubernetes integration, which includes dashboards, alert templates, and machine learning anomaly detection, is now available to all users of Elastic Cloud Hosted, Serverless, and self-managed deployments. The new Kubernetes investigation workflow and MCP application are currently in technical preview.
Comments