observability-sre-triage
Triage a degraded or suspect service end to end: read SLO status and burn rate, check active alerting rules and ML anomalies, measure throughput, latency, and error rate, assess dependency health and infrastructure saturation, and funnel logs down to the failures that explain it. Use when someone asks whether a service is healthy, why it is slow or erroring, what is in its logs, or which attribute distinguishes the requests that are failing. Also use when someone asks for the query behind any of those signals — throughput, latency percentiles, error rate, dependency health, or log volume — over APM/OTel traces, metrics, or logs.
Install
With your agent
Install OMGSkills skill "elastic/claude-plugin:skills/observability/sre-triage" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/elastic/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/observability/sre-triage ~/.claude/skills/observability-sre-triage
From README
SRE Service Triage Decide whether a service is healthy, degraded, or unhealthy, and say why. Triage is a hierarchy, not a checklist: SLOs and alerts define whether the service is failing its contract, trace-derived golden signals describe how it is failing, dependencies and infrastructure explain where the failure comes from, and logs supply the sentence you put in the incident channel. Work down the hierarchy until the evidence supports a verdict, then stop. For authoring and tuning SLO definitions, burn-rate rules, and alert thresholds, use the observability-service-reliability skill. This skill only reads that state. For Kubernetes workload, node, or control-plane diagnosis — restart loops, OOM kill confirmation, node pressure, admission rejections, stuck rollouts — hand off to the observability-k8s-investigation skill. This skill checks whether a Kubernetes-hosted service is saturated; it does not diagnose why the pod or the node behind it is failing.
More from this repo
cloud-onboarding
Onboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context and API key, establish a default...
cloud-provisioning
Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects...
elasticsearch-anomaly-detection
Used to create and manage Elastic ML anomaly detection jobs via the API.
