Skip to content

[9.3] [Obs AI] Replace get_data_sources with get_index_info tool (#248234)#249117

Closed
sorenlouv wants to merge 3 commits intoelastic:9.3from
sorenlouv:backport/9.3/pr-248234
Closed

[9.3] [Obs AI] Replace get_data_sources with get_index_info tool (#248234)#249117
sorenlouv wants to merge 3 commits intoelastic:9.3from
sorenlouv:backport/9.3/pr-248234

Conversation

@sorenlouv
Copy link
Member

Backport

This will backport the following commits from main to 9.3:

Questions ?

Please refer to the Backport tool documentation

…ic#248234)

Closes elastic/obs-ai-team#455

This PR introduces the `get_index_info` tool which replaces
`get_data_sources` and adds field discovery capabilities. This is
similar to the `get_dataset_info` tool we have for Obs AI Assistant.

### What it does

The tool has three operations:

**`get_index_info({ operation: "get-overview" })`**
Returns the same data sources as `get_data_sources` (APM indices, logs,
metrics, alerts) plus a list of curated observability fields that exist
in the cluster. Each field includes a `schema` indicator (`ecs`, `otel`,
or `internal`).

**`get_index_info({ operation: "list-fields", index, start?, end?,
kqlFilter?, intent? })`**
Returns fields with actual data. If the LLM specifies an `intent` and
there are >100 fields, we filter them using a model to just the relevant
ones.

**`get_index_info({ operation: "get-field-values", index, fields })`**
Returns field values:
- Distinct values for keyword fields
- Min/max ranges for numeric and date fields

### Purpose of tool

The LLM needs to know what fields exist in the user's cluster before
building queries. Without this, it guesses field names which leads to
invalid filters and confusing errors. This is especially important
because customers can use different schemas (ECS vs OTel).

## Manual testing

Run the synthtrace scenario to populate observability indices with test
data:

```bash
node scripts/synthtrace \
  src/platform/packages/shared/kbn-synthtrace/src/scenarios/agent_builder/tools/get_index_info/curated_fields.ts \
  --from "now-15m" --to "now" --clean --workers=1
```

### Execute tool to get overview

```
POST kbn:///api/agent_builder/tools/_execute
{
  "tool_id": "observability.get_index_info",
  "tool_params": { "operation": "get-overview" }
}
```

### Execute tool to get field values

```
POST kbn:///api/agent_builder/tools/_execute
{
  "tool_id": "observability.get_index_info",
  "tool_params": { "operation": "get-field-values", "index": "metrics-*", "fields": "host.name" }
}
```

(cherry picked from commit b6be8eb)

# Conflicts:
#	src/platform/packages/shared/kbn-synthtrace/src/scenarios/agent_builder/index.ts
#	x-pack/solutions/observability/plugins/observability_agent_builder/server/tools/get_data_sources/tool.ts
#	x-pack/solutions/observability/plugins/observability_agent_builder/server/tools/get_services/tool.ts
#	x-pack/solutions/observability/plugins/observability_agent_builder/server/tools/index.ts
#	x-pack/solutions/observability/test/api_integration_deployment_agnostic/apis/observability_agent_builder/index.ts
#	x-pack/solutions/observability/test/api_integration_deployment_agnostic/apis/observability_agent_builder/tools/get_data_sources.spec.ts
@sorenlouv sorenlouv added the backport This PR is a backport of another PR label Jan 14, 2026
@sorenlouv sorenlouv enabled auto-merge (squash) January 14, 2026 22:41
@sorenlouv sorenlouv added the backport This PR is a backport of another PR label Jan 14, 2026
@botelastic botelastic bot added the Team:obs-presentation Focus: APM UI, Infra UI, Hosts UI, Universal Profiling, Obs Overview and left Navigation label Jan 14, 2026
@elasticmachine
Copy link
Contributor

Pinging @elastic/obs-presentation-team (Team:obs-presentation)

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

@sorenlouv sorenlouv closed this Jan 19, 2026
auto-merge was automatically disabled January 19, 2026 12:52

Pull request was closed

@sorenlouv sorenlouv deleted the backport/9.3/pr-248234 branch January 19, 2026 12:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR Team:obs-presentation Focus: APM UI, Infra UI, Hosts UI, Universal Profiling, Obs Overview and left Navigation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants