From 7da0a64c5ed0d2eccd87f07759ae81f303f40026 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Thu, 22 Jan 2026 12:58:58 +0100 Subject: [PATCH 01/15] added markdown links to ai insgihts and obs agent --- .../agent/register_observability_agent.ts | 38 +++++++++++++++++-- .../apm_error/generate_error_ai_insight.ts | 3 ++ .../ai_insights/get_alert_ai_insights.ts | 3 ++ .../routes/ai_insights/get_log_ai_insights.ts | 6 ++- 4 files changed, 46 insertions(+), 4 deletions(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index d6abefb0e1243..d5f7792e0ac75 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -39,11 +39,12 @@ export async function registerObservabilityAgent({ configuration: { instructions: dedent(`You are an observability specialist agent that helps Site Reliability Engineers (SREs) investigate incidents and understand system health. - + ${getInvestigationInstructions()} ${getReasoningInstructions()} ${getFieldDiscoveryInstructions()} ${getKqlInstructions()} + ${getEntityLinkingInstructions()} `), tools: [{ tool_ids: OBSERVABILITY_AGENT_TOOL_IDS }], }, @@ -55,7 +56,7 @@ export async function registerObservabilityAgent({ function getInvestigationInstructions() { return dedent(` ### INVESTIGATION APPROACH - + Follow a progressive workflow - start broad, then narrow down: 1. **Triage**: What's the severity? How many users/services affected? 2. **Scope**: Which components are affected? What's the blast radius? @@ -69,7 +70,7 @@ function getInvestigationInstructions() { function getReasoningInstructions() { return dedent(` ### REASONING PRINCIPLES - + - **Be quantitative**: Quote specific metrics (error rate %, latency ms, throughput rpm). Avoid vague terms like "high" without numbers. - **Correlation ≠ causation**: Look for temporal sequence (what happened FIRST) and causal mechanism. - **Consider all layers**: Infrastructure (CPU, memory, disk) → Application (latency, throughput, failure rate) → Dependencies (databases, caches, external APIs). @@ -97,3 +98,34 @@ function getKqlInstructions() { - Use quotes for exact phrases in text fields: \`message: "connection refused"\` `); } + +/** + * Entity Linking instructions for Observability Agent Builder. + * Instructs the LLM to format entities as clickable links using Kibana's relative URL paths. + * + * Supported entity types: + * - APM: Services, Traces, Errors (individual and service-level), Transactions, Dependencies, Service Map + * - Logs: Service-specific logs and general logs explorer + * - Infrastructure: Hosts + * - Platform: Alerts + */ +export function getEntityLinkingInstructions() { + return dedent(` + ## Entity Linking Guidelines + Use markdown for readability. When referencing entities, create clickable links: + | Entity | Link Format | Example | + |--------|-------------|---------| + | Service | \`[](/app/apm/services/)\` | "The [payments](/app/apm/services/payments) service is experiencing high latency." | + | Transaction | \`[](/app/apm/services//transactions)\` | "The transaction [POST /checkout](/app/apm/services/payments/transactions) took 500ms." | + | Trace | \`[](/app/apm/link-to/trace/)\` | "See trace [8bc26008603e16819bd6fcfb80fceff5](/app/apm/link-to/trace/8bc26008603e16819bd6fcfb80fceff5)" | + | Error | \`[](/app/apm/services//errors/)\` | "Error [upstream-5xx](/app/apm/services/catalog-api/errors/upstream-5xx) suggests a dependency failure." | + | Service Errors | \`[errors](/app/apm/services//errors)\` | "Review all [errors](/app/apm/services/frontend/errors) for the [frontend](/app/apm/services/frontend) service." | + | Service Logs | \`[logs](/app/apm/services//logs)\` | "Check [logs](/app/apm/services/frontend/logs) for the [frontend](/app/apm/services/frontend) service." | + | Host | \`[](/app/metrics/detail/host/)\` | "Host [web-01](/app/metrics/detail/host/web-01) is experiencing high CPU usage." | + | Service Map | \`[Service Map](/app/apm/services//service-map)\` | "Check the [Service Map](/app/apm/services/payments/service-map) to see dependencies." | + | Dependencies | \`[Dependencies](/app/apm/services//dependencies)\` | "View [Dependencies](/app/apm/services/catalog-api/dependencies) to identify upstream issues." | + | Alert | \`[](/app/observability/alerts/)\` | "Alert [alert-uuid-123](/app/observability/alerts/alert-uuid-123) was triggered." | + | Logs Explorer | \`[Logs](/app/logs)\` | "View [Logs](/app/logs) to investigate the issue further." | + +`); +} diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts index c15ef3bdad324..ae07ffbdf712e 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts @@ -16,6 +16,7 @@ import type { ObservabilityAgentBuilderPluginSetupDependencies, } from '../../../types'; import { fetchApmErrorContext } from './fetch_apm_error_context'; +import { getEntityLinkingInstructions } from '../../../agent/register_observability_agent'; const ERROR_AI_INSIGHT_SYSTEM_PROMPT = dedent(` You are an expert SRE Assistant within Elastic Observability. Your job is to analyze an APM error using ONLY the provided context (APM trace items, related errors, downstream dependencies, and log categories). @@ -42,6 +43,8 @@ const ERROR_AI_INSIGHT_SYSTEM_PROMPT = dedent(` - : Related errors within the trace (type, message, culprit, spanId, timestampUs) - : Service aggregates for the trace (serviceName, count, errorCount) - : Categorized log patterns tied to the trace (errorCategory, docCount, sampleMessage) + + ${getEntityLinkingInstructions()} `); const buildUserPrompt = (errorContext: string) => { diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts index 495e9c1351dcf..ba13516cc4c2a 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts @@ -17,6 +17,7 @@ import type { ObservabilityAgentBuilderPluginSetupDependencies, } from '../../types'; import { getToolHandler as getLogCategories } from '../../tools/get_log_categories/handler'; +import { getEntityLinkingInstructions } from '../../agent/register_observability_agent'; /** * These types are derived from the generated alerts-as-data schemas: @@ -239,6 +240,8 @@ async function generateAlertSummary({ 3) Log categories: error messages and exception patterns 4) Errors: exception patterns with downstream context 5) Service summary: instance counts, versions, anomalies, and metadata + + ${getEntityLinkingInstructions()} `); const alertDetails = `\`\`\`json\n${JSON.stringify(alertDoc, null, 2)}\n\`\`\``; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts index be8b7611f792e..658dfd249989c 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts @@ -11,6 +11,7 @@ import { safeJsonStringify } from '@kbn/std'; import dedent from 'dedent'; import type { ObservabilityAgentBuilderDataRegistry } from '../../data_registry/data_registry'; import { getLogDocumentById } from './get_log_document_by_id'; +import { getEntityLinkingInstructions } from '../../agent/register_observability_agent'; export interface GetLogAiInsightsParams { index: string; @@ -33,7 +34,10 @@ export async function getLogAiInsights({ }: GetLogAiInsightsParams): Promise<{ summary: string; context: string }> { const systemPrompt = dedent(` You are assisting an SRE who is viewing a log entry in the Kibana Logs UI. - Using the provided data produce a concise, action-oriented response.`); + Using the provided data produce a concise, action-oriented response. + + ${getEntityLinkingInstructions()} + `); const logEntry = await getLogDocumentById({ esClient: esClient.asCurrentUser, From e6e40faab889f0483b8d04254473deb47a6a3566 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Fri, 23 Jan 2026 10:27:54 +0100 Subject: [PATCH 02/15] Update x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts Co-authored-by: Viduni Wickramarachchi --- .../server/agent/register_observability_agent.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index d5f7792e0ac75..28d673fa3d149 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -100,7 +100,7 @@ function getKqlInstructions() { } /** - * Entity Linking instructions for Observability Agent Builder. + * Entity Linking instructions for the Observability Agent * Instructs the LLM to format entities as clickable links using Kibana's relative URL paths. * * Supported entity types: From 87254ab91f4bdf6269d3eb846369b8d30900e959 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Mon, 26 Jan 2026 17:15:23 +0100 Subject: [PATCH 03/15] added spaces to markdown links for logs ai insights --- .../agent/register_observability_agent.ts | 33 ++++++++++++------- .../routes/ai_insights/get_log_ai_insights.ts | 4 ++- .../server/routes/ai_insights/route.ts | 5 ++- 3 files changed, 28 insertions(+), 14 deletions(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index 28d673fa3d149..44e216b618a58 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -7,6 +7,7 @@ import type { Logger } from '@kbn/core/server'; import dedent from 'dedent'; +import { addSpaceIdToPath, DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common'; import type { ObservabilityAgentBuilderCoreSetup, ObservabilityAgentBuilderPluginSetupDependencies, @@ -99,6 +100,13 @@ function getKqlInstructions() { `); } +function getSpacePrefix(spaceId?: string): string { + if (!spaceId || spaceId === DEFAULT_SPACE_ID) { + return ''; + } + return addSpaceIdToPath('', spaceId, '').replace(/\/$/, ''); +} + /** * Entity Linking instructions for the Observability Agent * Instructs the LLM to format entities as clickable links using Kibana's relative URL paths. @@ -109,23 +117,24 @@ function getKqlInstructions() { * - Infrastructure: Hosts * - Platform: Alerts */ -export function getEntityLinkingInstructions() { +export function getEntityLinkingInstructions(spaceId?: string) { + const prefix = getSpacePrefix(spaceId); return dedent(` ## Entity Linking Guidelines Use markdown for readability. When referencing entities, create clickable links: | Entity | Link Format | Example | |--------|-------------|---------| - | Service | \`[](/app/apm/services/)\` | "The [payments](/app/apm/services/payments) service is experiencing high latency." | - | Transaction | \`[](/app/apm/services//transactions)\` | "The transaction [POST /checkout](/app/apm/services/payments/transactions) took 500ms." | - | Trace | \`[](/app/apm/link-to/trace/)\` | "See trace [8bc26008603e16819bd6fcfb80fceff5](/app/apm/link-to/trace/8bc26008603e16819bd6fcfb80fceff5)" | - | Error | \`[](/app/apm/services//errors/)\` | "Error [upstream-5xx](/app/apm/services/catalog-api/errors/upstream-5xx) suggests a dependency failure." | - | Service Errors | \`[errors](/app/apm/services//errors)\` | "Review all [errors](/app/apm/services/frontend/errors) for the [frontend](/app/apm/services/frontend) service." | - | Service Logs | \`[logs](/app/apm/services//logs)\` | "Check [logs](/app/apm/services/frontend/logs) for the [frontend](/app/apm/services/frontend) service." | - | Host | \`[](/app/metrics/detail/host/)\` | "Host [web-01](/app/metrics/detail/host/web-01) is experiencing high CPU usage." | - | Service Map | \`[Service Map](/app/apm/services//service-map)\` | "Check the [Service Map](/app/apm/services/payments/service-map) to see dependencies." | - | Dependencies | \`[Dependencies](/app/apm/services//dependencies)\` | "View [Dependencies](/app/apm/services/catalog-api/dependencies) to identify upstream issues." | - | Alert | \`[](/app/observability/alerts/)\` | "Alert [alert-uuid-123](/app/observability/alerts/alert-uuid-123) was triggered." | - | Logs Explorer | \`[Logs](/app/logs)\` | "View [Logs](/app/logs) to investigate the issue further." | + | Service | \`[](${prefix}/app/apm/services/)\` | "The [payments](${prefix}/app/apm/services/payments) service is experiencing high latency." | + | Transaction | \`[](${prefix}/app/apm/services//transactions)\` | "The transaction [POST /checkout](${prefix}/app/apm/services/payments/transactions) took 500ms." | + | Trace | \`[](${prefix}/app/apm/link-to/trace/)\` | "See trace [8bc26008603e16819bd6fcfb80fceff5](${prefix}/app/apm/link-to/trace/8bc26008603e16819bd6fcfb80fceff5)" | + | Error | \`[](${prefix}/app/apm/services//errors/)\` | "Error [upstream-5xx](${prefix}/app/apm/services/catalog-api/errors/upstream-5xx) suggests a dependency failure." | + | Service Errors | \`[errors](${prefix}/app/apm/services//errors)\` | "Review all [errors](${prefix}/app/apm/services/frontend/errors) for the [frontend](${prefix}/app/apm/services/frontend) service." | + | Service Logs | \`[logs](${prefix}/app/apm/services//logs)\` | "Check [logs](${prefix}/app/apm/services/frontend/logs) for the [frontend](${prefix}/app/apm/services/frontend) service." | + | Host | \`[](${prefix}/app/metrics/detail/host/)\` | "Host [web-01](${prefix}/app/metrics/detail/host/web-01) is experiencing high CPU usage." | + | Service Map | \`[Service Map](${prefix}/app/apm/services//service-map)\` | "Check the [Service Map](${prefix}/app/apm/services/payments/service-map) to see dependencies." | + | Dependencies | \`[Dependencies](${prefix}/app/apm/services//dependencies)\` | "View [Dependencies](${prefix}/app/apm/services/catalog-api/dependencies) to identify upstream issues." | + | Alert | \`[](${prefix}/app/observability/alerts/)\` | "Alert [alert-uuid-123](${prefix}/app/observability/alerts/alert-uuid-123) was triggered." | + | Logs Explorer | \`[Logs](${prefix}/app/logs)\` | "View [Logs](${prefix}/app/logs) to investigate the issue further." | `); } diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts index 327d742ea2547..40d27872eabdd 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts @@ -18,6 +18,7 @@ import type { AiInsightResult, ContextEvent } from './types'; export interface GetLogAiInsightsParams { index: string; id: string; + spaceId: string; dataRegistry: ObservabilityAgentBuilderDataRegistry; inferenceClient: InferenceClient; connectorId: string; @@ -28,6 +29,7 @@ export interface GetLogAiInsightsParams { export async function getLogAiInsights({ index, id, + spaceId, request, esClient, dataRegistry, @@ -38,7 +40,7 @@ export async function getLogAiInsights({ You are assisting an SRE who is viewing a log entry in the Kibana Logs UI. Using the provided data produce a concise, action-oriented response. - ${getEntityLinkingInstructions()} + ${getEntityLinkingInstructions(spaceId)} `); const logEntry = await getLogDocumentById({ diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts index a376c25844a99..53ed6990b559e 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts @@ -135,15 +135,18 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const { index, id } = params.body; const [coreStart, startDeps] = await core.getStartServices(); - const { inference } = startDeps; + const { inference, spaces } = startDeps; const connectorId = await getDefaultConnectorId({ coreStart, inference, request }); const inferenceClient = inference.getClient({ request }); const esClient = coreStart.elasticsearch.client.asScoped(request); + const spaceId = spaces?.spacesService.getSpaceId(request) ?? 'default'; + const result = await getLogAiInsights({ index, id, + spaceId, inferenceClient, connectorId, request, From 793cc6d02929719725a229fd89279b971b63af18 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Tue, 27 Jan 2026 10:20:54 +0100 Subject: [PATCH 04/15] added current space to ai insights --- .../agent/register_observability_agent.ts | 42 ++++++--------- .../apm_error/generate_error_ai_insight.ts | 53 ++++++++++--------- .../server/routes/ai_insights/route.ts | 12 +++-- 3 files changed, 52 insertions(+), 55 deletions(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index 44e216b618a58..d9cf02e08bbf8 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -7,7 +7,6 @@ import type { Logger } from '@kbn/core/server'; import dedent from 'dedent'; -import { addSpaceIdToPath, DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common'; import type { ObservabilityAgentBuilderCoreSetup, ObservabilityAgentBuilderPluginSetupDependencies, @@ -100,41 +99,30 @@ function getKqlInstructions() { `); } -function getSpacePrefix(spaceId?: string): string { - if (!spaceId || spaceId === DEFAULT_SPACE_ID) { - return ''; - } - return addSpaceIdToPath('', spaceId, '').replace(/\/$/, ''); -} - /** * Entity Linking instructions for the Observability Agent * Instructs the LLM to format entities as clickable links using Kibana's relative URL paths. - * - * Supported entity types: - * - APM: Services, Traces, Errors (individual and service-level), Transactions, Dependencies, Service Map - * - Logs: Service-specific logs and general logs explorer - * - Infrastructure: Hosts - * - Platform: Alerts */ export function getEntityLinkingInstructions(spaceId?: string) { - const prefix = getSpacePrefix(spaceId); + const prefix = spaceId && spaceId !== 'default' ? `/s/${spaceId}` : ''; return dedent(` ## Entity Linking Guidelines - Use markdown for readability. When referencing entities, create clickable links: + Use markdown for readability. When referencing entities, create clickable links. + IMPORTANT: Do NOT wrap links in backticks - backticks prevent links from being clickable. + | Entity | Link Format | Example | |--------|-------------|---------| - | Service | \`[](${prefix}/app/apm/services/)\` | "The [payments](${prefix}/app/apm/services/payments) service is experiencing high latency." | - | Transaction | \`[](${prefix}/app/apm/services//transactions)\` | "The transaction [POST /checkout](${prefix}/app/apm/services/payments/transactions) took 500ms." | - | Trace | \`[](${prefix}/app/apm/link-to/trace/)\` | "See trace [8bc26008603e16819bd6fcfb80fceff5](${prefix}/app/apm/link-to/trace/8bc26008603e16819bd6fcfb80fceff5)" | - | Error | \`[](${prefix}/app/apm/services//errors/)\` | "Error [upstream-5xx](${prefix}/app/apm/services/catalog-api/errors/upstream-5xx) suggests a dependency failure." | - | Service Errors | \`[errors](${prefix}/app/apm/services//errors)\` | "Review all [errors](${prefix}/app/apm/services/frontend/errors) for the [frontend](${prefix}/app/apm/services/frontend) service." | - | Service Logs | \`[logs](${prefix}/app/apm/services//logs)\` | "Check [logs](${prefix}/app/apm/services/frontend/logs) for the [frontend](${prefix}/app/apm/services/frontend) service." | - | Host | \`[](${prefix}/app/metrics/detail/host/)\` | "Host [web-01](${prefix}/app/metrics/detail/host/web-01) is experiencing high CPU usage." | - | Service Map | \`[Service Map](${prefix}/app/apm/services//service-map)\` | "Check the [Service Map](${prefix}/app/apm/services/payments/service-map) to see dependencies." | - | Dependencies | \`[Dependencies](${prefix}/app/apm/services//dependencies)\` | "View [Dependencies](${prefix}/app/apm/services/catalog-api/dependencies) to identify upstream issues." | - | Alert | \`[](${prefix}/app/observability/alerts/)\` | "Alert [alert-uuid-123](${prefix}/app/observability/alerts/alert-uuid-123) was triggered." | - | Logs Explorer | \`[Logs](${prefix}/app/logs)\` | "View [Logs](${prefix}/app/logs) to investigate the issue further." | + | Service | [](${prefix}/app/apm/services/) | "The [payments](${prefix}/app/apm/services/payments) service is experiencing high latency." | + | Transaction | [](${prefix}/app/apm/services//transactions) | "The transaction [POST /checkout](${prefix}/app/apm/services/payments/transactions) took 500ms." | + | Trace | [](${prefix}/app/apm/link-to/trace/) | "See trace [8bc26008603e16819bd6fcfb80fceff5](${prefix}/app/apm/link-to/trace/8bc26008603e16819bd6fcfb80fceff5)" | + | Error | [](${prefix}/app/apm/services//errors/) | "Error [upstream-5xx](${prefix}/app/apm/services/catalog-api/errors/upstream-5xx) suggests a dependency failure." | + | Service Errors | [errors](${prefix}/app/apm/services//errors) | "Review all [errors](${prefix}/app/apm/services/frontend/errors) for the [frontend](${prefix}/app/apm/services/frontend) service." | + | Service Logs | [logs](${prefix}/app/apm/services//logs) | "Check [logs](${prefix}/app/apm/services/frontend/logs) for the [frontend](${prefix}/app/apm/services/frontend) service." | + | Host | [](${prefix}/app/metrics/detail/host/) | "Host [web-01](${prefix}/app/metrics/detail/host/web-01) is experiencing high CPU usage." | + | Service Map | [Service Map](${prefix}/app/apm/services//service-map) | "Check the [Service Map](${prefix}/app/apm/services/payments/service-map) to see dependencies." | + | Dependencies | [Dependencies](${prefix}/app/apm/services//dependencies) | "View [Dependencies](${prefix}/app/apm/services/catalog-api/dependencies) to identify upstream issues." | + | Alert | [](${prefix}/app/observability/alerts/) | "Alert [alert-uuid-123](${prefix}/app/observability/alerts/alert-uuid-123) was triggered." | + | Logs Explorer | [Logs](${prefix}/app/logs) | "View [Logs](${prefix}/app/logs) to investigate the issue further." | `); } diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts index 248e056997173..998c56b4febcc 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts @@ -20,34 +20,36 @@ import { fetchApmErrorContext } from './fetch_apm_error_context'; import { getEntityLinkingInstructions } from '../../../agent/register_observability_agent'; import type { AiInsightResult, ContextEvent } from '../types'; -const ERROR_AI_INSIGHT_SYSTEM_PROMPT = dedent(` - You are an expert SRE Assistant within Elastic Observability. Your job is to analyze an APM error using ONLY the provided context (APM trace items, related errors, downstream dependencies, and log categories). +function getErrorAiInsightSystemPrompt(spaceId?: string) { + return dedent(` + You are an expert SRE Assistant within Elastic Observability. Your job is to analyze an APM error using ONLY the provided context (APM trace items, related errors, downstream dependencies, and log categories). - Output structure (concise, Markdown): - - Error summary (1-2 sentences): What is observed and why it matters. - - Failure pinpoint: Whether failure is in application code vs dependency. Name the likely failing component/endpoint. Reference specific fields or key frames if available. - - Impact: Scope and severity (services/endpoints and the extent of the error if evident). - - Immediate actions (2-4): Ordered, concrete steps (config/network checks, retries/backoff, circuit breakers, targeted tracing/logging). - - Open questions: Short list of unknowns and the quickest queries to resolve them, if any (this is strictly optional and should not be present if there are no open questions). + Output structure (concise, Markdown): + - Error summary (1-2 sentences): What is observed and why it matters. + - Failure pinpoint: Whether failure is in application code vs dependency. Name the likely failing component/endpoint. Reference specific fields or key frames if available. + - Impact: Scope and severity (services/endpoints and the extent of the error if evident). + - Immediate actions (2-4): Ordered, concrete steps (config/network checks, retries/backoff, circuit breakers, targeted tracing/logging). + - Open questions: Short list of unknowns and the quickest queries to resolve them, if any (this is strictly optional and should not be present if there are no open questions). - Guardrails: - - Strict Factuality: Only mention signals present in the JSON. If a signal is missing, do not mention it. - - Only assert a cause if multiple signals support it. Otherwise mark Assessment "Inconclusive". - - Prefer corroborated explanations. If only one source supports it, state that support is limited. - - Do NOT repeat raw stacks verbatim (reference only key frames/fields). - - Conciseness: Use bullet points. Avoid flowery language. Be direct and technical. + Guardrails: + - Strict Factuality: Only mention signals present in the JSON. If a signal is missing, do not mention it. + - Only assert a cause if multiple signals support it. Otherwise mark Assessment "Inconclusive". + - Prefer corroborated explanations. If only one source supports it, state that support is limited. + - Do NOT repeat raw stacks verbatim (reference only key frames/fields). + - Conciseness: Use bullet points. Avoid flowery language. Be direct and technical. - Available context tags: - - : Full error document (exception, message, stacktrace, labels) - - : Transaction linked to the error (if present) - - : Downstream dependencies for the erroring service - - : Span/transaction samples with service, name, type, eventOutcome, statusCode, duration, httpUrl, downstreamServiceResource - - : Related errors within the trace (type, message, culprit, spanId, timestampUs) - - : Service aggregates for the trace (serviceName, count, errorCount) - - : Categorized log patterns tied to the trace (errorCategory, docCount, sampleMessage) + Available context tags: + - : Full error document (exception, message, stacktrace, labels) + - : Transaction linked to the error (if present) + - : Downstream dependencies for the erroring service + - : Span/transaction samples with service, name, type, eventOutcome, statusCode, duration, httpUrl, downstreamServiceResource + - : Related errors within the trace (type, message, culprit, spanId, timestampUs) + - : Service aggregates for the trace (serviceName, count, errorCount) + - : Categorized log patterns tied to the trace (errorCategory, docCount, sampleMessage) - ${getEntityLinkingInstructions()} -`); + ${getEntityLinkingInstructions(spaceId)} + `); +} const buildUserPrompt = (errorContext: string) => { return dedent(` @@ -80,6 +82,7 @@ export interface GenerateErrorAiInsightParams { export async function generateErrorAiInsight({ core, plugins, + spaceId, errorId, serviceName, environment, @@ -106,7 +109,7 @@ export async function generateErrorAiInsight({ const userPrompt = buildUserPrompt(errorContext); const events$ = inferenceClient.chatComplete({ - system: ERROR_AI_INSIGHT_SYSTEM_PROMPT, + system: getErrorAiInsightSystemPrompt(spaceId), messages: [ { role: MessageRole.User, diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts index 53ed6990b559e..91e9149fd868c 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts @@ -8,6 +8,7 @@ import * as t from 'io-ts'; import type { ServerRouteRepository } from '@kbn/server-route-repository-utils'; import { apiPrivileges } from '@kbn/agent-builder-plugin/common/features'; +import { getCurrentSpaceId } from '@kbn/agent-builder-plugin/server/utils/spaces'; import { observableIntoEventSourceStream } from '@kbn/sse-utils-server'; import { getRequestAbortedSignal } from '@kbn/inference-plugin/server/routes/get_request_aborted_signal'; import { generateErrorAiInsight } from './apm_error/generate_error_ai_insight'; @@ -36,7 +37,7 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const { alertId } = params.body; const [coreStart, startDeps] = await core.getStartServices(); - const { inference, ruleRegistry } = startDeps; + const { inference, ruleRegistry, spaces } = startDeps; const connectorId = await getDefaultConnectorId({ coreStart, inference, request, logger }); const inferenceClient = inference.getClient({ request }); @@ -44,6 +45,8 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const alertsClient = await ruleRegistry.getRacClientWithRequest(request); const alertDoc = (await alertsClient.get({ id: alertId })) as AlertDocForInsight; + const spaceId = getCurrentSpaceId({ spaces, request }); + const result = await getAlertAiInsight({ core, plugins, @@ -87,14 +90,17 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const { errorId, serviceName, start, end, environment = '' } = params.body; const [coreStart, startDeps] = await core.getStartServices(); - const { inference } = startDeps; + const { inference, spaces } = startDeps; const connectorId = await getDefaultConnectorId({ coreStart, inference, request, logger }); const inferenceClient = inference.getClient({ request, bindTo: { connectorId } }); + const spaceId = getCurrentSpaceId({ spaces, request }); + const result = await generateErrorAiInsight({ core, plugins, + spaceId, errorId, serviceName, start, @@ -141,7 +147,7 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const inferenceClient = inference.getClient({ request }); const esClient = coreStart.elasticsearch.client.asScoped(request); - const spaceId = spaces?.spacesService.getSpaceId(request) ?? 'default'; + const spaceId = getCurrentSpaceId({ spaces, request }); const result = await getLogAiInsights({ index, From c5417891632a26fd5fbeb3fa0b9384c4fc233237 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Tue, 27 Jan 2026 15:12:12 +0100 Subject: [PATCH 05/15] added space aware links to alert ai insight --- .../server/routes/ai_insights/get_alert_ai_insights.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts index 8510e9b362e5e..692d25423cb48 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts @@ -57,6 +57,7 @@ export async function getAlertAiInsight({ core, plugins, alertDoc, + spaceId, inferenceClient, connectorId, dataRegistry, @@ -75,6 +76,7 @@ export async function getAlertAiInsight({ inferenceClient, connectorId, alertDoc, + spaceId, context: relatedContext, }); @@ -211,11 +213,13 @@ function generateAlertSummary({ inferenceClient, connectorId, alertDoc, + spaceId, context, }: { inferenceClient: InferenceClient; connectorId: string; alertDoc: AlertDocForInsight; + spaceId: string; context: string; }): Observable { const systemPrompt = dedent(` @@ -244,7 +248,7 @@ function generateAlertSummary({ 4) Errors: exception patterns with downstream context 5) Service summary: instance counts, versions, anomalies, and metadata - ${getEntityLinkingInstructions()} + ${getEntityLinkingInstructions(spaceId)} `); const alertDetails = `\`\`\`json\n${JSON.stringify(alertDoc, null, 2)}\n\`\`\``; From deb9333f3ff9b8d95702d1c9ed62bc1126026045 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Tue, 27 Jan 2026 17:21:50 +0100 Subject: [PATCH 06/15] added dynamic configuration for space-aware agent instructions --- .../agents/builtin_definition.ts | 12 +++++++++++- .../agent-builder-server/agents/index.ts | 1 + .../server/services/agents/modes/create_handler.ts | 10 +++++++++- .../server/agent/register_observability_agent.ts | 6 +++--- 4 files changed, 24 insertions(+), 5 deletions(-) diff --git a/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/builtin_definition.ts b/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/builtin_definition.ts index a3599fafcde50..eb03c2efc2688 100644 --- a/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/builtin_definition.ts +++ b/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/builtin_definition.ts @@ -13,6 +13,14 @@ import type { AgentDefinition, AgentConfiguration } from '@kbn/agent-builder-com /** Same type for now */ export type BuiltInAgentConfiguration = AgentConfiguration; +/** + * Context passed to dynamic configuration handlers. + */ +export interface AgentConfigContext { + request: KibanaRequest; + spaceId: string; +} + /** * Represents a built-in agent definition, as registered by the consumers using the agents setup contract. */ @@ -20,7 +28,9 @@ export type BuiltInAgentDefinition = Pick< AgentDefinition, 'id' | 'name' | 'description' | 'labels' | 'avatar_icon' | 'avatar_symbol' | 'avatar_color' > & { - configuration: BuiltInAgentConfiguration; + configuration: + | BuiltInAgentConfiguration + | ((ctx: AgentConfigContext) => MaybePromise); /** * Optional dynamic availability configuration. */ diff --git a/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/index.ts b/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/index.ts index 57fa6519c1d48..4f97ba704e03b 100644 --- a/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/index.ts +++ b/x-pack/platform/packages/shared/agent-builder/agent-builder-server/agents/index.ts @@ -24,6 +24,7 @@ export type { export type { BuiltInAgentDefinition, BuiltInAgentConfiguration, + AgentConfigContext, AgentAvailabilityContext, AgentAvailabilityHandler, AgentAvailabilityResult, diff --git a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts index 778d99335e3f2..2b775ed8c77ae 100644 --- a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts +++ b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts @@ -33,8 +33,16 @@ export const createAgentHandler = ({ }, context ) => { + const resolvedConfiguration = + typeof agent.configuration === 'function' + ? await agent.configuration({ + spaceId: context.spaceId, + request: context.request, + }) + : agent.configuration; + const effectiveConfiguration = { - ...agent.configuration, + ...resolvedConfiguration, ...(configurationOverrides || {}), }; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index d9cf02e08bbf8..777c2e30005b2 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -36,7 +36,7 @@ export async function registerObservabilityAgent({ return getAgentBuilderResourceAvailability({ core, request, logger }); }, }, - configuration: { + configuration: ({ spaceId }) => ({ instructions: dedent(`You are an observability specialist agent that helps Site Reliability Engineers (SREs) investigate incidents and understand system health. @@ -44,10 +44,10 @@ export async function registerObservabilityAgent({ ${getReasoningInstructions()} ${getFieldDiscoveryInstructions()} ${getKqlInstructions()} - ${getEntityLinkingInstructions()} + ${getEntityLinkingInstructions(spaceId)} `), tools: [{ tool_ids: OBSERVABILITY_AGENT_TOOL_IDS }], - }, + }), }); logger.debug('Successfully registered observability agent in agent-builder'); From c5f9cba315d76cb79f9fbb4f231dcf1cd1175ce6 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Tue, 27 Jan 2026 17:50:17 +0100 Subject: [PATCH 07/15] removed unneeded parameters --- .../server/routes/ai_insights/get_log_ai_insights.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts index 40d27872eabdd..600146b0b79e8 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts @@ -18,7 +18,6 @@ import type { AiInsightResult, ContextEvent } from './types'; export interface GetLogAiInsightsParams { index: string; id: string; - spaceId: string; dataRegistry: ObservabilityAgentBuilderDataRegistry; inferenceClient: InferenceClient; connectorId: string; From b6e6c135c245351bdeaf2920115d178ca56c656e Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Tue, 27 Jan 2026 18:44:07 +0100 Subject: [PATCH 08/15] fixed check type --- .../server/services/agents/agent_registry.ts | 8 +++++++- .../ai_insights/apm_error/generate_error_ai_insight.ts | 1 + .../server/routes/ai_insights/get_alert_ai_insights.ts | 1 + .../server/routes/ai_insights/get_log_ai_insights.ts | 1 + .../server/routes/ai_insights/route.ts | 1 + 5 files changed, 11 insertions(+), 1 deletion(-) diff --git a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts index 545b9f31af0bf..d9ce98e14b02b 100644 --- a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts +++ b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts @@ -13,6 +13,8 @@ import { validateAgentId } from '@kbn/agent-builder-common/agents'; import type { AgentAvailabilityContext, AgentAvailabilityResult, + BuiltInAgentConfiguration, + AgentConfigContext, } from '@kbn/agent-builder-server/agents'; import type { UiSettingsServiceStart } from '@kbn/core-ui-settings-server'; import type { SavedObjectsServiceStart } from '@kbn/core-saved-objects-server'; @@ -26,7 +28,11 @@ import type { WritableAgentProvider, ReadonlyAgentProvider } from './agent_sourc import { isReadonlyProvider } from './agent_source'; // internal definition for our agents -export type InternalAgentDefinition = AgentDefinition & { +// Override configuration to support both static and dynamic (function) configuration +export type InternalAgentDefinition = Omit & { + configuration: + | BuiltInAgentConfiguration + | ((ctx: AgentConfigContext) => MaybePromise); isAvailable: InternalAgentDefinitionAvailabilityHandler; }; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts index 998c56b4febcc..0bd69ae919a26 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts @@ -67,6 +67,7 @@ const buildUserPrompt = (errorContext: string) => { export interface GenerateErrorAiInsightParams { core: ObservabilityAgentBuilderCoreSetup; plugins: ObservabilityAgentBuilderPluginSetupDependencies; + spaceId: string; errorId: string; serviceName: string; environment?: string; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts index 692d25423cb48..ea4883f647941 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts @@ -46,6 +46,7 @@ interface GetAlertAiInsightParams { core: ObservabilityAgentBuilderCoreSetup; plugins: ObservabilityAgentBuilderPluginSetupDependencies; alertDoc: AlertDocForInsight; + spaceId: string; inferenceClient: InferenceClient; connectorId: string; dataRegistry: ObservabilityAgentBuilderDataRegistry; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts index 600146b0b79e8..40d27872eabdd 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts @@ -18,6 +18,7 @@ import type { AiInsightResult, ContextEvent } from './types'; export interface GetLogAiInsightsParams { index: string; id: string; + spaceId: string; dataRegistry: ObservabilityAgentBuilderDataRegistry; inferenceClient: InferenceClient; connectorId: string; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts index 91e9149fd868c..6aa5409a38b05 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts @@ -51,6 +51,7 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR core, plugins, alertDoc, + spaceId, inferenceClient, connectorId, dataRegistry, From 454aa1980e7c3d5e701382d818cc7cd6d84c286a Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Wed, 28 Jan 2026 10:45:53 +0100 Subject: [PATCH 09/15] Update x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Søren Louv-Jansen --- .../server/agent/register_observability_agent.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index 777c2e30005b2..5fe4b457e850c 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -106,7 +106,7 @@ function getKqlInstructions() { export function getEntityLinkingInstructions(spaceId?: string) { const prefix = spaceId && spaceId !== 'default' ? `/s/${spaceId}` : ''; return dedent(` - ## Entity Linking Guidelines + ### Entity Linking Guidelines Use markdown for readability. When referencing entities, create clickable links. IMPORTANT: Do NOT wrap links in backticks - backticks prevent links from being clickable. From 7729f928693368a96e07abc85fe46bf83676dde3 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Wed, 28 Jan 2026 11:57:39 +0100 Subject: [PATCH 10/15] resolved dynamic agent configuration in builtin provider --- .../server/services/agents/agent_registry.ts | 8 +------ .../services/agents/builtin/provider.ts | 24 +++++++++++++++---- .../services/agents/modes/create_handler.ts | 10 +------- 3 files changed, 21 insertions(+), 21 deletions(-) diff --git a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts index d9ce98e14b02b..545b9f31af0bf 100644 --- a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts +++ b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/agent_registry.ts @@ -13,8 +13,6 @@ import { validateAgentId } from '@kbn/agent-builder-common/agents'; import type { AgentAvailabilityContext, AgentAvailabilityResult, - BuiltInAgentConfiguration, - AgentConfigContext, } from '@kbn/agent-builder-server/agents'; import type { UiSettingsServiceStart } from '@kbn/core-ui-settings-server'; import type { SavedObjectsServiceStart } from '@kbn/core-saved-objects-server'; @@ -28,11 +26,7 @@ import type { WritableAgentProvider, ReadonlyAgentProvider } from './agent_sourc import { isReadonlyProvider } from './agent_source'; // internal definition for our agents -// Override configuration to support both static and dynamic (function) configuration -export type InternalAgentDefinition = Omit & { - configuration: - | BuiltInAgentConfiguration - | ((ctx: AgentConfigContext) => MaybePromise); +export type InternalAgentDefinition = AgentDefinition & { isAvailable: InternalAgentDefinitionAvailabilityHandler; }; diff --git a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/builtin/provider.ts b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/builtin/provider.ts index 223c954b5550e..2bd8dc779a68f 100644 --- a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/builtin/provider.ts +++ b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/builtin/provider.ts @@ -7,7 +7,7 @@ import type { KibanaRequest } from '@kbn/core-http-server'; import { AgentType, createAgentNotFoundError } from '@kbn/agent-builder-common'; -import type { BuiltInAgentDefinition } from '@kbn/agent-builder-server/agents'; +import type { BuiltInAgentDefinition, AgentConfigContext } from '@kbn/agent-builder-server/agents'; import type { BuiltinAgentRegistry } from './registry'; import type { AgentProviderFn, ReadonlyAgentProvider } from '../agent_source'; import type { InternalAgentDefinition } from '../agent_registry'; @@ -19,20 +19,24 @@ export const createBuiltinProviderFn = ({ registry: BuiltinAgentRegistry; }): AgentProviderFn => { const availabilityCache = new AgentAvailabilityCache(); - return ({ request }) => { - return registryToProvider({ registry, request, availabilityCache }); + return ({ request, space }) => { + return registryToProvider({ registry, request, space, availabilityCache }); }; }; const registryToProvider = ({ registry, request, + space, availabilityCache, }: { registry: BuiltinAgentRegistry; request: KibanaRequest; + space: string; availabilityCache: AgentAvailabilityCache; }): ReadonlyAgentProvider => { + const configContext: AgentConfigContext = { request, spaceId: space }; + return { id: 'builtin', readonly: true, @@ -44,12 +48,14 @@ const registryToProvider = ({ if (!definition) { throw createAgentNotFoundError({ agentId }); } - return toInternalDefinition({ definition, availabilityCache }); + return toInternalDefinition({ definition, availabilityCache, configContext }); }, list: (opts) => { const definitions = registry.list(); return Promise.all( - definitions.map((definition) => toInternalDefinition({ definition, availabilityCache })) + definitions.map((definition) => + toInternalDefinition({ definition, availabilityCache, configContext }) + ) ); }, }; @@ -58,12 +64,20 @@ const registryToProvider = ({ export const toInternalDefinition = async ({ definition, availabilityCache, + configContext, }: { definition: BuiltInAgentDefinition; availabilityCache: AgentAvailabilityCache; + configContext: AgentConfigContext; }): Promise => { + const configuration = + typeof definition.configuration === 'function' + ? await definition.configuration(configContext) + : definition.configuration; + return { ...definition, + configuration, type: AgentType.chat, readonly: true, isAvailable: async (ctx) => { diff --git a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts index c3da66ad37478..fec110d3fdffd 100644 --- a/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts +++ b/x-pack/platform/plugins/shared/agent_builder/server/services/agents/modes/create_handler.ts @@ -33,16 +33,8 @@ export const createAgentHandler = ({ }, context ) => { - const resolvedConfiguration = - typeof agent.configuration === 'function' - ? await agent.configuration({ - spaceId: context.spaceId, - request: context.request, - }) - : agent.configuration; - const effectiveConfiguration = { - ...resolvedConfiguration, + ...agent.configuration, ...(configurationOverrides || {}), }; From d7b4432be05dc79b3d5172a9cf0bdc9ada31d5d9 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Wed, 28 Jan 2026 18:32:43 +0100 Subject: [PATCH 11/15] fixed basePath markdown links --- .../agent/register_observability_agent.ts | 30 +++++++++++++------ .../apm_error/generate_error_ai_insight.ts | 14 +++++++-- .../ai_insights/get_alert_ai_insights.ts | 7 ++++- .../routes/ai_insights/get_log_ai_insights.ts | 7 ++++- .../server/routes/ai_insights/route.ts | 3 +- 5 files changed, 45 insertions(+), 16 deletions(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index 5fe4b457e850c..067ae24b017b0 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -36,18 +36,22 @@ export async function registerObservabilityAgent({ return getAgentBuilderResourceAvailability({ core, request, logger }); }, }, - configuration: ({ spaceId }) => ({ - instructions: - dedent(`You are an observability specialist agent that helps Site Reliability Engineers (SREs) investigate incidents and understand system health. + configuration: ({ spaceId }) => { + const basePath = core.http.basePath.serverBasePath; + + return { + instructions: + dedent(`You are an observability specialist agent that helps Site Reliability Engineers (SREs) investigate incidents and understand system health. ${getInvestigationInstructions()} ${getReasoningInstructions()} ${getFieldDiscoveryInstructions()} ${getKqlInstructions()} - ${getEntityLinkingInstructions(spaceId)} + ${getEntityLinkingInstructions({ basePath, spaceId })} `), - tools: [{ tool_ids: OBSERVABILITY_AGENT_TOOL_IDS }], - }), + tools: [{ tool_ids: OBSERVABILITY_AGENT_TOOL_IDS }], + }; + }, }); logger.debug('Successfully registered observability agent in agent-builder'); @@ -100,11 +104,19 @@ function getKqlInstructions() { } /** - * Entity Linking instructions for the Observability Agent + * Entity Linking instructions for the Observability Agent. * Instructs the LLM to format entities as clickable links using Kibana's relative URL paths. */ -export function getEntityLinkingInstructions(spaceId?: string) { - const prefix = spaceId && spaceId !== 'default' ? `/s/${spaceId}` : ''; +export function getEntityLinkingInstructions({ + basePath, + spaceId, +}: { + basePath: string; + spaceId?: string; +}): string { + const spacePrefix = spaceId && spaceId !== 'default' ? `/s/${spaceId}` : ''; + const prefix = `${basePath}${spacePrefix}`; + return dedent(` ### Entity Linking Guidelines Use markdown for readability. When referencing entities, create clickable links. diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts index 0bd69ae919a26..cf7c92f0b636c 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts @@ -20,7 +20,13 @@ import { fetchApmErrorContext } from './fetch_apm_error_context'; import { getEntityLinkingInstructions } from '../../../agent/register_observability_agent'; import type { AiInsightResult, ContextEvent } from '../types'; -function getErrorAiInsightSystemPrompt(spaceId?: string) { +function getErrorAiInsightSystemPrompt({ + basePath, + spaceId, +}: { + basePath: string; + spaceId: string; +}) { return dedent(` You are an expert SRE Assistant within Elastic Observability. Your job is to analyze an APM error using ONLY the provided context (APM trace items, related errors, downstream dependencies, and log categories). @@ -47,7 +53,7 @@ function getErrorAiInsightSystemPrompt(spaceId?: string) { - : Service aggregates for the trace (serviceName, count, errorCount) - : Categorized log patterns tied to the trace (errorCategory, docCount, sampleMessage) - ${getEntityLinkingInstructions(spaceId)} + ${getEntityLinkingInstructions({ basePath, spaceId })} `); } @@ -94,6 +100,8 @@ export async function generateErrorAiInsight({ inferenceClient, dataRegistry, }: GenerateErrorAiInsightParams): Promise { + const basePath = core.http.basePath.serverBasePath; + const errorContext = await fetchApmErrorContext({ core, plugins, @@ -110,7 +118,7 @@ export async function generateErrorAiInsight({ const userPrompt = buildUserPrompt(errorContext); const events$ = inferenceClient.chatComplete({ - system: getErrorAiInsightSystemPrompt(spaceId), + system: getErrorAiInsightSystemPrompt({ basePath, spaceId }), messages: [ { role: MessageRole.User, diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts index ea4883f647941..85cb812b4b8d7 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts @@ -65,6 +65,8 @@ export async function getAlertAiInsight({ request, logger, }: GetAlertAiInsightParams): Promise { + const basePath = core.http.basePath.serverBasePath; + const relatedContext = await fetchAlertContext({ core, plugins, @@ -77,6 +79,7 @@ export async function getAlertAiInsight({ inferenceClient, connectorId, alertDoc, + basePath, spaceId, context: relatedContext, }); @@ -214,12 +217,14 @@ function generateAlertSummary({ inferenceClient, connectorId, alertDoc, + basePath, spaceId, context, }: { inferenceClient: InferenceClient; connectorId: string; alertDoc: AlertDocForInsight; + basePath: string; spaceId: string; context: string; }): Observable { @@ -249,7 +254,7 @@ function generateAlertSummary({ 4) Errors: exception patterns with downstream context 5) Service summary: instance counts, versions, anomalies, and metadata - ${getEntityLinkingInstructions(spaceId)} + ${getEntityLinkingInstructions({ basePath, spaceId })} `); const alertDetails = `\`\`\`json\n${JSON.stringify(alertDoc, null, 2)}\n\`\`\``; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts index 40d27872eabdd..b2c76885e4ba2 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts @@ -11,11 +11,13 @@ import { safeJsonStringify } from '@kbn/std'; import dedent from 'dedent'; import { concat, of } from 'rxjs'; import type { ObservabilityAgentBuilderDataRegistry } from '../../data_registry/data_registry'; +import type { ObservabilityAgentBuilderCoreSetup } from '../../types'; import { getLogDocumentById } from './get_log_document_by_id'; import { getEntityLinkingInstructions } from '../../agent/register_observability_agent'; import type { AiInsightResult, ContextEvent } from './types'; export interface GetLogAiInsightsParams { + core: ObservabilityAgentBuilderCoreSetup; index: string; id: string; spaceId: string; @@ -27,6 +29,7 @@ export interface GetLogAiInsightsParams { } export async function getLogAiInsights({ + core, index, id, spaceId, @@ -36,11 +39,13 @@ export async function getLogAiInsights({ inferenceClient, connectorId, }: GetLogAiInsightsParams): Promise { + const basePath = core.http.basePath.serverBasePath; + const systemPrompt = dedent(` You are assisting an SRE who is viewing a log entry in the Kibana Logs UI. Using the provided data produce a concise, action-oriented response. - ${getEntityLinkingInstructions(spaceId)} + ${getEntityLinkingInstructions({ basePath, spaceId })} `); const logEntry = await getLogDocumentById({ diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts index 6aa5409a38b05..488400b20ebbb 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts @@ -95,7 +95,6 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const connectorId = await getDefaultConnectorId({ coreStart, inference, request, logger }); const inferenceClient = inference.getClient({ request, bindTo: { connectorId } }); - const spaceId = getCurrentSpaceId({ spaces, request }); const result = await generateErrorAiInsight({ @@ -147,10 +146,10 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const connectorId = await getDefaultConnectorId({ coreStart, inference, request }); const inferenceClient = inference.getClient({ request }); const esClient = coreStart.elasticsearch.client.asScoped(request); - const spaceId = getCurrentSpaceId({ spaces, request }); const result = await getLogAiInsights({ + core, index, id, spaceId, From 26d6bf9cbf9875d0721afe61aae816711f92eee6 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Wed, 28 Jan 2026 22:24:42 +0100 Subject: [PATCH 12/15] use request to build base path --- .../agent/register_observability_agent.ts | 40 ++++++++----------- .../apm_error/generate_error_ai_insight.ts | 14 ++----- .../ai_insights/get_alert_ai_insights.ts | 13 +++--- .../routes/ai_insights/get_log_ai_insights.ts | 4 +- 4 files changed, 26 insertions(+), 45 deletions(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts index 067ae24b017b0..a288c6708eb66 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/agent/register_observability_agent.ts @@ -36,8 +36,8 @@ export async function registerObservabilityAgent({ return getAgentBuilderResourceAvailability({ core, request, logger }); }, }, - configuration: ({ spaceId }) => { - const basePath = core.http.basePath.serverBasePath; + configuration: ({ request }) => { + const urlPrefix = core.http.basePath.get(request); return { instructions: @@ -47,7 +47,7 @@ export async function registerObservabilityAgent({ ${getReasoningInstructions()} ${getFieldDiscoveryInstructions()} ${getKqlInstructions()} - ${getEntityLinkingInstructions({ basePath, spaceId })} + ${getEntityLinkingInstructions({ urlPrefix })} `), tools: [{ tool_ids: OBSERVABILITY_AGENT_TOOL_IDS }], }; @@ -107,16 +107,7 @@ function getKqlInstructions() { * Entity Linking instructions for the Observability Agent. * Instructs the LLM to format entities as clickable links using Kibana's relative URL paths. */ -export function getEntityLinkingInstructions({ - basePath, - spaceId, -}: { - basePath: string; - spaceId?: string; -}): string { - const spacePrefix = spaceId && spaceId !== 'default' ? `/s/${spaceId}` : ''; - const prefix = `${basePath}${spacePrefix}`; - +export function getEntityLinkingInstructions({ urlPrefix }: { urlPrefix: string }): string { return dedent(` ### Entity Linking Guidelines Use markdown for readability. When referencing entities, create clickable links. @@ -124,17 +115,18 @@ export function getEntityLinkingInstructions({ | Entity | Link Format | Example | |--------|-------------|---------| - | Service | [](${prefix}/app/apm/services/) | "The [payments](${prefix}/app/apm/services/payments) service is experiencing high latency." | - | Transaction | [](${prefix}/app/apm/services//transactions) | "The transaction [POST /checkout](${prefix}/app/apm/services/payments/transactions) took 500ms." | - | Trace | [](${prefix}/app/apm/link-to/trace/) | "See trace [8bc26008603e16819bd6fcfb80fceff5](${prefix}/app/apm/link-to/trace/8bc26008603e16819bd6fcfb80fceff5)" | - | Error | [](${prefix}/app/apm/services//errors/) | "Error [upstream-5xx](${prefix}/app/apm/services/catalog-api/errors/upstream-5xx) suggests a dependency failure." | - | Service Errors | [errors](${prefix}/app/apm/services//errors) | "Review all [errors](${prefix}/app/apm/services/frontend/errors) for the [frontend](${prefix}/app/apm/services/frontend) service." | - | Service Logs | [logs](${prefix}/app/apm/services//logs) | "Check [logs](${prefix}/app/apm/services/frontend/logs) for the [frontend](${prefix}/app/apm/services/frontend) service." | - | Host | [](${prefix}/app/metrics/detail/host/) | "Host [web-01](${prefix}/app/metrics/detail/host/web-01) is experiencing high CPU usage." | - | Service Map | [Service Map](${prefix}/app/apm/services//service-map) | "Check the [Service Map](${prefix}/app/apm/services/payments/service-map) to see dependencies." | - | Dependencies | [Dependencies](${prefix}/app/apm/services//dependencies) | "View [Dependencies](${prefix}/app/apm/services/catalog-api/dependencies) to identify upstream issues." | - | Alert | [](${prefix}/app/observability/alerts/) | "Alert [alert-uuid-123](${prefix}/app/observability/alerts/alert-uuid-123) was triggered." | - | Logs Explorer | [Logs](${prefix}/app/logs) | "View [Logs](${prefix}/app/logs) to investigate the issue further." | + | Service | [](${urlPrefix}/app/apm/services/) | "The [payments](${urlPrefix}/app/apm/services/payments) service is experiencing high latency." | + | Transaction | [](${urlPrefix}/app/apm/services//transactions) | "The transaction [POST /checkout](${urlPrefix}/app/apm/services/payments/transactions) took 500ms." | + | Trace | [](${urlPrefix}/app/apm/link-to/trace/) | "See trace [8bc26008603e16819bd6fcfb80fceff5](${urlPrefix}/app/apm/link-to/trace/8bc26008603e16819bd6fcfb80fceff5)" | + | Error | [](${urlPrefix}/app/apm/services//errors/) | "Error [upstream-5xx](${urlPrefix}/app/apm/services/catalog-api/errors/upstream-5xx) suggests a dependency failure." | + | Service Errors | [errors](${urlPrefix}/app/apm/services//errors) | "Review all [errors](${urlPrefix}/app/apm/services/frontend/errors) for the [frontend](${urlPrefix}/app/apm/services/frontend) service." | + | Service Logs | [logs](${urlPrefix}/app/apm/services//logs) | "Check [logs](${urlPrefix}/app/apm/services/frontend/logs) for the [frontend](${urlPrefix}/app/apm/services/frontend) service." | + | Host | [](${urlPrefix}/app/metrics/detail/host/) | "Host [web-01](${urlPrefix}/app/metrics/detail/host/web-01) is experiencing high CPU usage." | + | Service Map | [Service Map](${urlPrefix}/app/apm/services//service-map) | "Check the [Service Map](${urlPrefix}/app/apm/services/payments/service-map) to see dependencies." | + | Dependencies | [Dependencies](${urlPrefix}/app/apm/services//dependencies) | "View [Dependencies](${urlPrefix}/app/apm/services/catalog-api/dependencies) to identify upstream issues." | + | Alert | [](${urlPrefix}/app/observability/alerts/) | "Alert [alert-uuid-123](${urlPrefix}/app/observability/alerts/alert-uuid-123) was triggered." | + | Alert Rules | [](${urlPrefix}/app/observability/alerts/rules/) | "Alert Rule [alert-uuid-123](${urlPrefix}/app/observability/alerts/rules/alert-uuid-123)." | + | Logs Explorer | [Logs](${urlPrefix}/app/logs) | "View [Logs](${urlPrefix}/app/logs) to investigate the issue further." | `); } diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts index cf7c92f0b636c..732751f8c2460 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts @@ -20,13 +20,7 @@ import { fetchApmErrorContext } from './fetch_apm_error_context'; import { getEntityLinkingInstructions } from '../../../agent/register_observability_agent'; import type { AiInsightResult, ContextEvent } from '../types'; -function getErrorAiInsightSystemPrompt({ - basePath, - spaceId, -}: { - basePath: string; - spaceId: string; -}) { +function getErrorAiInsightSystemPrompt({ urlPrefix }: { urlPrefix: string }) { return dedent(` You are an expert SRE Assistant within Elastic Observability. Your job is to analyze an APM error using ONLY the provided context (APM trace items, related errors, downstream dependencies, and log categories). @@ -53,7 +47,7 @@ function getErrorAiInsightSystemPrompt({ - : Service aggregates for the trace (serviceName, count, errorCount) - : Categorized log patterns tied to the trace (errorCategory, docCount, sampleMessage) - ${getEntityLinkingInstructions({ basePath, spaceId })} + ${getEntityLinkingInstructions({ urlPrefix })} `); } @@ -100,7 +94,7 @@ export async function generateErrorAiInsight({ inferenceClient, dataRegistry, }: GenerateErrorAiInsightParams): Promise { - const basePath = core.http.basePath.serverBasePath; + const urlPrefix = core.http.basePath.get(request); const errorContext = await fetchApmErrorContext({ core, @@ -118,7 +112,7 @@ export async function generateErrorAiInsight({ const userPrompt = buildUserPrompt(errorContext); const events$ = inferenceClient.chatComplete({ - system: getErrorAiInsightSystemPrompt({ basePath, spaceId }), + system: getErrorAiInsightSystemPrompt({ urlPrefix }), messages: [ { role: MessageRole.User, diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts index 85cb812b4b8d7..dea70fe3dbbc4 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts @@ -65,7 +65,7 @@ export async function getAlertAiInsight({ request, logger, }: GetAlertAiInsightParams): Promise { - const basePath = core.http.basePath.serverBasePath; + const urlPrefix = core.http.basePath.get(request); const relatedContext = await fetchAlertContext({ core, @@ -79,8 +79,7 @@ export async function getAlertAiInsight({ inferenceClient, connectorId, alertDoc, - basePath, - spaceId, + urlPrefix, context: relatedContext, }); @@ -215,17 +214,15 @@ async function fetchAlertContext({ function generateAlertSummary({ inferenceClient, + urlPrefix, connectorId, alertDoc, - basePath, - spaceId, context, }: { inferenceClient: InferenceClient; + urlPrefix: string; connectorId: string; alertDoc: AlertDocForInsight; - basePath: string; - spaceId: string; context: string; }): Observable { const systemPrompt = dedent(` @@ -254,7 +251,7 @@ function generateAlertSummary({ 4) Errors: exception patterns with downstream context 5) Service summary: instance counts, versions, anomalies, and metadata - ${getEntityLinkingInstructions({ basePath, spaceId })} + ${getEntityLinkingInstructions({ urlPrefix })} `); const alertDetails = `\`\`\`json\n${JSON.stringify(alertDoc, null, 2)}\n\`\`\``; diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts index b2c76885e4ba2..f5b3cfffd843b 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts @@ -39,13 +39,11 @@ export async function getLogAiInsights({ inferenceClient, connectorId, }: GetLogAiInsightsParams): Promise { - const basePath = core.http.basePath.serverBasePath; - const systemPrompt = dedent(` You are assisting an SRE who is viewing a log entry in the Kibana Logs UI. Using the provided data produce a concise, action-oriented response. - ${getEntityLinkingInstructions({ basePath, spaceId })} + ${getEntityLinkingInstructions({ urlPrefix: core.http.basePath.get(request) })} `); const logEntry = await getLogDocumentById({ From e7b600be65f9abafcf21c46468f863e856679565 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Wed, 28 Jan 2026 22:31:49 +0100 Subject: [PATCH 13/15] remove unneeded param --- .../ai_insights/apm_error/generate_error_ai_insight.ts | 2 -- .../server/routes/ai_insights/get_alert_ai_insights.ts | 2 -- .../server/routes/ai_insights/get_log_ai_insights.ts | 2 -- .../server/routes/ai_insights/route.ts | 9 +-------- 4 files changed, 1 insertion(+), 14 deletions(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts index 732751f8c2460..5f0e01decf8fb 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/apm_error/generate_error_ai_insight.ts @@ -67,7 +67,6 @@ const buildUserPrompt = (errorContext: string) => { export interface GenerateErrorAiInsightParams { core: ObservabilityAgentBuilderCoreSetup; plugins: ObservabilityAgentBuilderPluginSetupDependencies; - spaceId: string; errorId: string; serviceName: string; environment?: string; @@ -83,7 +82,6 @@ export interface GenerateErrorAiInsightParams { export async function generateErrorAiInsight({ core, plugins, - spaceId, errorId, serviceName, environment, diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts index dea70fe3dbbc4..9a2d19e00514e 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_alert_ai_insights.ts @@ -46,7 +46,6 @@ interface GetAlertAiInsightParams { core: ObservabilityAgentBuilderCoreSetup; plugins: ObservabilityAgentBuilderPluginSetupDependencies; alertDoc: AlertDocForInsight; - spaceId: string; inferenceClient: InferenceClient; connectorId: string; dataRegistry: ObservabilityAgentBuilderDataRegistry; @@ -58,7 +57,6 @@ export async function getAlertAiInsight({ core, plugins, alertDoc, - spaceId, inferenceClient, connectorId, dataRegistry, diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts index f5b3cfffd843b..61fc3aa41fa44 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/get_log_ai_insights.ts @@ -20,7 +20,6 @@ export interface GetLogAiInsightsParams { core: ObservabilityAgentBuilderCoreSetup; index: string; id: string; - spaceId: string; dataRegistry: ObservabilityAgentBuilderDataRegistry; inferenceClient: InferenceClient; connectorId: string; @@ -32,7 +31,6 @@ export async function getLogAiInsights({ core, index, id, - spaceId, request, esClient, dataRegistry, diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts index 488400b20ebbb..b7a293e433d14 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts @@ -45,13 +45,10 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const alertsClient = await ruleRegistry.getRacClientWithRequest(request); const alertDoc = (await alertsClient.get({ id: alertId })) as AlertDocForInsight; - const spaceId = getCurrentSpaceId({ spaces, request }); - const result = await getAlertAiInsight({ core, plugins, alertDoc, - spaceId, inferenceClient, connectorId, dataRegistry, @@ -91,16 +88,14 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const { errorId, serviceName, start, end, environment = '' } = params.body; const [coreStart, startDeps] = await core.getStartServices(); - const { inference, spaces } = startDeps; + const { inference } = startDeps; const connectorId = await getDefaultConnectorId({ coreStart, inference, request, logger }); const inferenceClient = inference.getClient({ request, bindTo: { connectorId } }); - const spaceId = getCurrentSpaceId({ spaces, request }); const result = await generateErrorAiInsight({ core, plugins, - spaceId, errorId, serviceName, start, @@ -146,13 +141,11 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const connectorId = await getDefaultConnectorId({ coreStart, inference, request }); const inferenceClient = inference.getClient({ request }); const esClient = coreStart.elasticsearch.client.asScoped(request); - const spaceId = getCurrentSpaceId({ spaces, request }); const result = await getLogAiInsights({ core, index, id, - spaceId, inferenceClient, connectorId, request, From fe7ba067008b24fc00c953bae3183fec9154fce4 Mon Sep 17 00:00:00 2001 From: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Date: Wed, 28 Jan 2026 21:55:47 +0000 Subject: [PATCH 14/15] Changes from node scripts/eslint_all_files --no-cache --fix --- .../server/routes/ai_insights/route.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts index b7a293e433d14..03c33a90a1092 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts @@ -8,7 +8,6 @@ import * as t from 'io-ts'; import type { ServerRouteRepository } from '@kbn/server-route-repository-utils'; import { apiPrivileges } from '@kbn/agent-builder-plugin/common/features'; -import { getCurrentSpaceId } from '@kbn/agent-builder-plugin/server/utils/spaces'; import { observableIntoEventSourceStream } from '@kbn/sse-utils-server'; import { getRequestAbortedSignal } from '@kbn/inference-plugin/server/routes/get_request_aborted_signal'; import { generateErrorAiInsight } from './apm_error/generate_error_ai_insight'; From a59e57be8f6aeeca002c8158ade0f26822997da6 Mon Sep 17 00:00:00 2001 From: Yuliia Fryshko Date: Thu, 29 Jan 2026 09:22:37 +0100 Subject: [PATCH 15/15] remove unused variable --- .../server/routes/ai_insights/route.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts index 03c33a90a1092..c31deb68002e2 100644 --- a/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts +++ b/x-pack/solutions/observability/plugins/observability_agent_builder/server/routes/ai_insights/route.ts @@ -36,7 +36,7 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const { alertId } = params.body; const [coreStart, startDeps] = await core.getStartServices(); - const { inference, ruleRegistry, spaces } = startDeps; + const { inference, ruleRegistry } = startDeps; const connectorId = await getDefaultConnectorId({ coreStart, inference, request, logger }); const inferenceClient = inference.getClient({ request }); @@ -135,7 +135,7 @@ export function getObservabilityAgentBuilderAiInsightsRouteRepository(): ServerR const { index, id } = params.body; const [coreStart, startDeps] = await core.getStartServices(); - const { inference, spaces } = startDeps; + const { inference } = startDeps; const connectorId = await getDefaultConnectorId({ coreStart, inference, request }); const inferenceClient = inference.getClient({ request });