Elastic Observability Gives SREs a Head Start on Kubernetes Incident Investigations
Elastic introduces automated Kubernetes investigation workflows and MCP-based observability skills to accelerate incident resolution for SREs by identifying root causes before alerts are acknowledged.
Elastic has launched agentic Kubernetes investigation workflows and MCP-based observability skills that automatically diagnose incidents when alerts trigger. The system identifies root causes, compiles evidence, and suggests next steps before SREs are notified, reducing the time between alert and resolution. This addresses the operational cost of delays in large-scale Kubernetes environments, where outages can compound while engineers investigate manually.
The new capabilities integrate with existing tools like Claude, Cursor, VS Code, and MCP-compatible clients, allowing SREs to investigate Kubernetes environments conversationally. Engineers can query live data from Elasticsearch and view interactive details such as cluster health, service dependencies, anomalies, and blast radius analysis directly within their IDEs. Persistent alert rule management is also supported, streamlining ongoing monitoring.
Elastic Observability stores Kubernetes logs and metrics with 2.5x better storage efficiency than other vendors, ensuring engineers have comprehensive operational context. The agentic workflow either confirms a root cause or provides a structured starting point, eliminating the need to begin investigations from scratch. This reduces cognitive load during critical incidents, particularly during off-hours.
The Kubernetes integration, including dashboards, alert templates, and ML anomaly detection, is available across Elastic Cloud Hosted, Serverless, and self-managed deployments. The investigation workflow and MCP App are currently in technical preview, with access available via elastic.co or Elastic’s blogs. Elastic’s Search AI Platform underpins these solutions, supporting thousands of enterprise customers.