Elastic Agent Builder agents overview

Agents are AI models (LLMs) defined with custom instructions and a set of assigned tools. Stack 9.4+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Agents can also be equipped with skills, which are reusable instruction sets that provide specialized expertise. Users chat with agents using natural language, in the Agent Builder UI or programmatically.

An agent parses user requests to define a goal and then runs tools in a loop to achieve that goal. The agent provides responses based on its configured tools, instructions, and behavior settings.

When you ask a question to an agent, it analyzes your request to define a specific goal. It selects the most appropriate tools and determines the right arguments to use. The agent evaluates the information returned after each action and decides whether to use additional tools or formulate a response. This iterative process of tool selection, execution, and analysis continues until the agent can provide a complete answer.

Elastic Agent Builder includes a default agent named Elastic AI Agent. You can create custom agents with custom instructions and selected tools to address specific use cases or workflows.

You can also use pre-configured built-in agents that are specialized for common use cases.

Agents tailor their guidance on features, navigation, and terminology to the Elastic deployment they run in, and they can answer questions about that deployment directly. To make this possible, Elastic Agent Builder adds details about the deployment to the instructions of every agent, built-in or custom. The details depend on the deployment type:

• Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Hosted, Elastic Cloud Enterprise, and self-managed: The environment, the Elastic Stack version, and, when available, the space's solution view and the license type and status. If Kibana is configured as air-gapped, the details also say so.
• Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Elastic Cloud Serverless: The environment, the project type, and the product tier, when the project has one.

Elastic Agent Builder adds these details automatically, and you can't turn them off. Agents can share these details with anyone who chats with them, even though they don't disclose their other instructions.

Elastic Agent Builder includes a pre-configured built-in agent optimized for common use cases, which you can also customize using custom instructions, tools, and skills.

• Elastic AI Agent: The default general-purpose agent

For the complete list of built-in agents and their assigned tools, refer to Built-in agents reference.

Create custom agents tailored to your specific needs by defining custom instructions and selecting relevant tools. Custom agents give you full control over:

• Agent behavior and personality through custom instructions
• Available tools and capabilities
• Stack 9.4+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Assigned skills for specialized expertise
• Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Subagents the agent can delegate tasks to
• Visual appearance and organization

Custom agents are space-aware: they are only available in the Kibana space where they were created.

To learn how to create and manage custom agents, refer to Custom agents.

The Agents page provides a centralized view of all your agents. From this page you can:

• View all your agents with their names and labels
• Search for specific agents using the search bar
• Filter agents by labels using the Labels dropdown
• Create new agents using the New agent button
• Start chatting with an agent or perform other actions:

  • Built-in agents: You can chat or clone built-in agents. They cannot be edited or deleted.

    
    

  • Custom agents: You can chat, edit, clone, or delete custom agents.

    
    

The Enable Elastic capabilities toggle controls whether an agent is automatically assigned all current and future Elastic-built tools, skills, and plugins. The set of assigned capabilities is dynamic and grows as Elastic adds new built-in content. Disable this toggle to manage tool, skill, and plugin assignments manually.

This toggle is available for all agents, both built-in and custom.

Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The toggle doesn't affect the HTTP API tools, which every agent has.

Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Preview Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. This toggle doesn't assign connectors, but it includes the connector-discovery skill that agents need to find their assigned connectors. You assign connectors to each agent separately, and agents start with none, including the built-in Elastic AI Agent. For details, refer to Assign connectors to an agent.

• Built-in agents: Elastic capabilities are enabled by default. Disable if you want to limit the agent to the tools and skills you assign. Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The agent keeps the HTTP API tools.
• Custom agents: Elastic capabilities are disabled by default. Enable if you want the agent to have access to all current and future Elastic-built tools, skills, and plugins.

To review which tools and skills are active, open the agent's Tools or Skills tab after enabling the toggle. Elastic-provided items are marked with a lock icon.

An agent can delegate tasks to subagents. A subagent is another agent that works on a task separately and returns the result. The agent can also delegate to a copy of itself. In the UI, that copy is labeled This agent (self-fork), and it has the same custom instructions, tools, and skills as the agent. Use subagents to split a complex request into focused tasks, or to hand part of the work to an agent with specialized instructions and tools.

The agent decides when to delegate a task and writes the task instructions for the subagent. The subagent doesn't see the conversation, only those instructions.

The agent can wait for a subagent to finish, or let the subagent run in the background while it continues working. Background subagents are available only in saved conversations.

In a saved conversation, the agent can also start a named subagent and send it follow-up tasks later in that conversation with the send_message_to_agent tool. The named subagent keeps the history of those tasks. If you approve APIs for the first task, that approval does not apply to the follow-up tasks.

The subagent returns its result to the agent, not to you, and the agent uses it in its response. To review what a subagent did, select the run_subagent tool call in the conversation, then select the Sub-agent execution link.

• A subagent can't delegate tasks to its own subagents.
• The agent can only delegate to agents that you can access. The UI and the API accept only those agents. When the agent runs, it skips agents in the Delegable subagents list that you can't access or that were deleted.
• Before it delegates a task that can modify or delete data, the agent might ask you to approve the APIs the subagent can call. If you select Deny, the subagent runs without access to those APIs.
• Subagents can't show you confirmation prompts. For details, refer to Human-in-the-loop prompts require an interactive conversation.

New custom agents have subagents turned off. By default, the Elastic AI Agent can delegate to a copy of itself. If the Elastic AI Agent existed in a space before subagents were available, for example after an upgrade, it keeps its configuration without subagents.

To change an agent's subagents, you need permission to edit the agent.

1. Edit the agent and go to the Subagents section of the Settings tab. You can also select Edit agent settings on the agent's Overview page.
2. Select Enable subagents. This agent (self-fork) appears under Delegable subagents.
3. Under Delegable subagents, select the other agents this agent can delegate to. To stop the agent from delegating to a copy of itself, remove This agent (self-fork).
4. Select Save.

The following example shows an agent that can delegate tasks to a copy of itself and to one custom agent:

To configure subagents with the Agents API, set configuration.subagent_ids when you create or update an agent:

• The list takes up to 50 unique agent IDs.
• To let the agent delegate to a copy of itself, use _self. You can't use the agent's own ID.
• An empty list turns subagents off.
• If you omit subagent_ids when you update an agent, the agent keeps its current list.

The Agents API enables programmatic management of both built-in and custom agents.

For an overview, refer to Agents API.

For the complete API reference, refer to the Kibana API reference.

• Custom agents
• Best practices for prompt engineering in Elastic Agent Builder
• Built-in agents reference
• Tools
• Skills in Elastic Agent Builder