Elasticsearch has native integrations with the industry-leading Gen AI tools and providers. Check out our webinars on going Beyond RAG Basics, or building prod-ready apps with the Elastic vector database.
To build the best search solutions for your use case, start a free cloud trial or try Elastic on your local machine now.
With Elastic's new Agent Builder, you can create specialized AI agents that act as experts for your specific business domains. This feature moves you beyond simple dashboards and search bars, transforming your data from a passive resource into an active, conversational partner.
Imagine a financial manager who needs to get up to speed before a client meeting. Instead of manually digging through news feeds and cross-referencing portfolio dashboards, they can now simply ask their custom-built agent a direct question. This is the benefit of a "chat-first" approach. The manager has a direct, conversational line to their data, asking things like, "What's the latest news on ACME Corp and how does it affect my client's holdings?" and getting a synthesized, expert answer in seconds.
While we're building a financial expert today, the applications are as varied as your data. The same power can create a cybersecurity analyst to hunt for threats, a site reliability engineer to diagnose an outage, or a marketing manager to optimize a campaign. No matter the domain, the core mission is the same: transform your data into a specialist you can chat with.
Step 0: Our Dataset
Our dataset today is a synthetic financial based dataset consisting of financial accounts, asset positions, news, and financial reports. While synthetic, it replicates a simplified version of a real financial dataset.
financial_accounts: Customer portfolios with risk profiles
financial_holdings: Stock/ETF/bond positions with purchase history
financial_asset_details: Details about the stock/ETF/bond
financial_news: AI-generated market articles with sentiment analysis
financial_reports: Company earnings and analyst notes
You can load this dataset yourself by following the accompanying notebook located here.
Step 1: The Foundation — Your Business Logic as ES|QL
Every AI skill starts with a solid piece of logic. For our Financial Manager agent, we need to teach it how to answer a common question: “I'm worried about market sentiment. Can you show me which of our clients are most at risk from bad news?” This question goes beyond a simple search. It requires us to correlate market sentiment with client portfolios.
We need to find the assets mentioned in negative articles, identify every client holding those assets, calculate the current market value of their exposure, and then rank the results to prioritize the highest risk. This complex, multi-join analysis is the perfect job for our advanced ES|QL tool.
Here is the complete query we'll use. It looks impressive, but the concepts are straightforward.
Breaking It Down: Joins and Guardrails
There are two important concepts at play in this query that make the Agent Builder.
1. The LOOKUP JOIN
For years, one of the most requested features in Elasticsearch has been the ability to join data from different indices based on a common key. With ES|QL, that's now possible with LOOKUP JOIN.
In our new query, we perform a chain of three LOOKUP JOIN's: first connecting negative news to asset details, then linking those assets to client holdings, and finally joining to the client's account information. This creates an incredibly rich result from four different indices in a single, efficient query. This means we can combine disparate datasets to create a single, insightful answer without having to denormalize all our data into one giant index beforehand.
2. Parameters as LLM Guardrails
You'll notice the query uses ?time_duration. This isn't just a variable; it's a guardrail for the AI. While Large Language Models (LLMs) are great at generating queries, letting them have free rein over your data can lead to inefficient or even incorrect queries.
By creating a parameterized query, we force the LLM to work within the tested, efficient, and correct business logic that a human expert has already defined. It's similar to how developers have used search templates for years to safely expose query capabilities to applications. The agent can interpret a user's request like "this week" to fill the time_duration parameter, but it must use our query structure to obtain the answer. This gives us the perfect balance of flexibility and control.
Ultimately, this query allows an expert who understands the data to encapsulate their knowledge into a tool. Other people—and AI agents—can then use that tool to get, correlated results by simply providing a single parameter, without needing to know anything about the underlying complexity.
Step 2: The Skill — Turning a Query into a Reusable Tool
An ES|QL query is just text until we register it as a tool. In the Agent Builder, a tool is more than just a saved query; it's a "skill" that an AI agent can understand and choose to use. The magic is in the natural language description we provide. This description is the bridge that connects a user's question to the underlying query logic. Let's register the query we just built.
The UI Path
Creating a tool in Kibana is a straightforward process.