Elastic Stack

Elastic Stack (ELK Stack) Elastic Agents API

Elastic Agents APIs enable you to manage Elastic Agents, including retrieving agent information, managing agent lifecycle, handling file uploads, and initiating agent setup.

GitHub OpenAPI
Business capability
IT Operations Management BC-600.40

Operations 18

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/fleet/agent_status/data Check which data streams agents are sending to · Get incoming agent data #
Ask an LLM
“Is my newly enrolled agent actually sending data yet?”
“Which data streams is a given agent writing to?”
Tell an agent
Check incoming data for agents {agent_ids}.
Show data from agents {agent_ids} for package {pkg_name}.
GET /api/fleet/agents List Fleet agents · Get agents #
Ask an LLM
“Which Elastic Agents are enrolled in Fleet?”
“Can I list only agents that are eligible for an upgrade?”
Tell an agent
List all enrolled Fleet agents.
Find agents matching {kuery}.
POST /api/fleet/agents Find agents by action IDs · Get agents by action ids #
Ask an LLM
“Which agents were targeted by a particular Fleet action?”
“Can I look up agents from a list of action IDs?”
Tell an agent
Get the agents associated with actions {action_ids}.
Show which agents action {action_ids} applied to.
DELETE /api/fleet/agents/{agentId} Delete a Fleet agent · Delete an agent #
Ask an LLM
“How do I remove an agent record from Fleet?”
“Can I delete an agent that no longer exists?”
Tell an agent destructive · confirm first
Delete agent {agent_id}.
Remove agent {agent_id} from Fleet.
GET /api/fleet/agents/{agentId} Get a Fleet agent · Get an agent #
Ask an LLM
“What status and policy does a specific agent have?”
“Can I see CPU and memory metrics for one agent?”
Tell an agent
Show agent {agent_id}.
Get agent {agent_id} with metrics included.
PUT /api/fleet/agents/{agentId} Update an agent's tags or metadata · Update an agent by ID #
Ask an LLM
“Can I add tags to an enrolled agent?”
“How do I set user-provided metadata on an agent?”
Tell an agent
Set the tags on agent {agent_id} to {tags}.
Update metadata of agent {agent_id} to {metadata}.
GET /api/fleet/agents/{agentId}/effective_config Get an agent's effective configuration · Get an agent's effective config #
Ask an LLM
“What configuration is an agent actually running with?”
“Can I see the merged effective config of one agent?”
Tell an agent
Show the effective config of agent {agent_id}.
Fetch the running configuration for {agent_id}.
POST /api/fleet/agents/{agentId}/migrate Migrate one agent to another cluster · Migrate a single agent #
Ask an LLM
“Can I move a single agent to a different Fleet cluster?”
“What do I need to migrate an agent to a new Fleet Server?”
Tell an agent
Migrate agent {agent_id} to {uri} using token {token}.
Move agent {agent_id} to cluster {uri} with enrollment token {token}.
POST /api/fleet/agents/{agentId}/privilege_level_change Make one agent run unprivileged · Change agent privilege level #
Ask an LLM
“Can I switch a single agent to run without root privileges?”
“How do I drop an agent down to unprivileged mode?”
Tell an agent
Change agent {agent_id} to unprivileged.
Run agent {agent_id} unprivileged as user {user_info}.
GET /api/fleet/agents/{agentId}/uploads List files uploaded by an agent · Get agent uploads #
Ask an LLM
“What diagnostic files has a particular agent uploaded?”
“Can I see an agent's upload history?”
Tell an agent
List the uploads from agent {agent_id}.
Show files uploaded by {agent_id}.
GET /api/fleet/agents/available_versions List agent versions available for upgrade · Get available agent versions #
Ask an LLM
“Which Elastic Agent versions can I upgrade to?”
“What is the newest agent version Fleet offers?”
Tell an agent
List available Elastic Agent versions.
Show the versions my agents can be upgraded to.
POST /api/fleet/agents/bulk_migrate Migrate many agents to another cluster · Migrate multiple agents #
Ask an LLM
“Can I move a batch of agents to a new cluster at once?”
“Is there a dry run before bulk migrating agents?”
Tell an agent
Migrate agents {agents} to {uri} with token {token}.
Dry-run migrating {agents} to {uri} using token {token}: {dry_run}.
POST /api/fleet/agents/bulk_privilege_level_change Make many agents run unprivileged · Bulk change agent privilege level #
Ask an LLM
“Can I switch a whole group of agents to unprivileged mode?”
“What batch size is used when bulk-changing agent privileges?”
Tell an agent
Change agents {agents} to unprivileged.
Bulk-drop privileges for {agents} in batches of {batch_size}.
DELETE /api/fleet/agents/files/{fileId} Delete a file uploaded by an agent · Delete an uploaded file #
Ask an LLM
“Can I remove a diagnostics bundle an agent uploaded?”
“How do I delete an old agent upload to free space?”
Tell an agent destructive · confirm first
Delete uploaded file {file_id}.
Remove agent upload {file_id}.
GET /api/fleet/agents/files/{fileId}/{fileName} Download a file uploaded by an agent · Get an uploaded file #
Ask an LLM
“How can I download the diagnostics file an agent uploaded?”
“Where do I retrieve an agent's uploaded file by name?”
Tell an agent
Download file {file_name} with ID {file_id}.
Fetch agent upload {file_id} named {file_name}.
GET /api/fleet/agents/setup Check whether Fleet is ready to enroll agents · Get agent setup info #
Ask an LLM
“Is Fleet ready to enroll agents yet?”
“Which Fleet requirements are still missing in my deployment?”
Tell an agent
Check the Fleet setup status.
Tell me what Fleet needs before agents can enroll.
POST /api/fleet/agents/setup Initialize Fleet · Initiate Fleet setup #
Ask an LLM
“How do I trigger Fleet setup?”
“Is it safe to call Fleet initialization more than once?”
Tell an agent
Initialize Fleet.
Run Fleet setup again with the kbn-xsrf header set to {xsrf}.
GET /api/fleet/agents/tags List tags used across agents · Get agent tags #
Ask an LLM
“What tags are applied to my enrolled agents?”
“Can I include tags from inactive agents?”
Tell an agent
List all agent tags.
Show tags on agents matching {kuery}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-elastic-agents-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-elastic-agents-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-elastic-agents-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Elastic Agents API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (104 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-elastic-agents-api-openapi.yml