chore: release v0.3.1

.github/.release-manifest.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.3.0",
+  "version": "0.3.1",
   "source_repo": "elastic/agent-skills",
-  "sandbox_sha": "092aaa6a6c68a4f0553145c90c86ea157721ae2e",
+  "sandbox_sha": "9b3fa5cb2cb8a643d1faf3d2b650bb80e4d7c68e",
   "skills": {
     "skills/cloud/access-management": {
       "name": "cloud-access-management",
@@ -37,7 +37,7 @@
     },
     "skills/elasticsearch/elasticsearch-esql": {
       "name": "elasticsearch-esql",
-      "version": "0.3.0"
+      "version": "0.4.0"
     },
     "skills/elasticsearch/elasticsearch-file-ingest": {
       "name": "elasticsearch-file-ingest",

.github/plugin/marketplace.json

@@ -1,41 +1,41 @@
 {
-  "name": "elastic-agent-skills",
-  "owner": {
-    "name": "Elastic"
-  },
-  "metadata": {
-    "description": "Official Elastic agent skills for Elasticsearch, Kibana, Observability, Security, and Cloud"
-  },
   "plugins": [
     {
+      "version": "0.3.1",
       "name": "elasticsearch",
       "source": "./plugins/elasticsearch",
-      "description": "Elasticsearch skills — ES|QL queries, data ingestion, security (authn, authz, audit), and troubleshooting",
-      "version": "0.3.0"
+      "description": "Elasticsearch skills — ES|QL queries, data ingestion, security (authn, authz, audit), and troubleshooting"
     },
     {
+      "version": "0.3.1",
       "name": "kibana",
       "source": "./plugins/kibana",
-      "description": "Kibana skills — dashboards, alerting rules, connectors, Vega visualizations, Agent Builder, streams, and audit logging",
-      "version": "0.3.0"
+      "description": "Kibana skills — dashboards, alerting rules, connectors, Vega visualizations, Agent Builder, streams, and audit logging"
     },
     {
+      "version": "0.3.1",
       "name": "observability",
       "source": "./plugins/observability",
-      "description": "Elastic Observability skills — OpenTelemetry instrumentation and migration (.NET, Java, Python), LLM observability, log search, SLOs, and service health",
-      "version": "0.3.0"
+      "description": "Elastic Observability skills — OpenTelemetry instrumentation and migration (.NET, Java, Python), LLM observability, log search, SLOs, and service health"
     },
     {
+      "version": "0.3.1",
       "name": "security",
       "source": "./plugins/security",
-      "description": "Elastic Security skills — alert triage, case management, detection rule management, and sample data generation",
-      "version": "0.3.0"
+      "description": "Elastic Security skills — alert triage, case management, detection rule management, and sample data generation"
     },
     {
+      "version": "0.3.1",
       "name": "cloud",
       "source": "./plugins/cloud",
-      "description": "Elastic Cloud skills — project setup, access management, network security, and Serverless project lifecycle",
-      "version": "0.3.0"
+      "description": "Elastic Cloud skills — project setup, access management, network security, and Serverless project lifecycle"
     }
-  ]
+  ],
+  "name": "elastic-agent-skills",
+  "owner": {
+    "name": "Elastic"
+  },
+  "metadata": {
+    "description": "Official Elastic agent skills for Elasticsearch, Kibana, Observability, Security, and Cloud"
+  }
 }

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## v0.3.1
+
+### Updated Skills
+
+- `skills/elasticsearch/elasticsearch-esql` (v0.3.0 → v0.4.0)
+- `skills/elasticsearch/elasticsearch-onboarding` (v0.1.0)
+
+### Generated Artifacts
+
+- Regenerated README skill table
+
 ## v0.3.0
 
 ### New Skills

README.md

@@ -59,7 +59,7 @@ Skills in this repository focus on:
 | [elasticsearch-audit](skills/elasticsearch/elasticsearch-audit/SKILL.md) | Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins. | 0.1.0 | elastic |
 | [elasticsearch-authn](skills/elasticsearch/elasticsearch-authn/SKILL.md) | Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured. | 0.1.0 | elastic |
 | [elasticsearch-authz](skills/elasticsearch/elasticsearch-authz/SKILL.md) | Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP/SAML. | 0.1.1 | elastic |
-| [elasticsearch-esql](skills/elasticsearch/elasticsearch-esql/SKILL.md) | Execute ES\|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES\|QL results. | 0.3.0 | elastic |
+| [elasticsearch-esql](skills/elasticsearch/elasticsearch-esql/SKILL.md) | Execute ES\|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES\|QL results. | 0.4.0 | elastic |
 | [elasticsearch-file-ingest](skills/elasticsearch/elasticsearch-file-ingest/SKILL.md) | Ingest and transform data files (CSV/JSON/Parquet/Arrow IPC) into Elasticsearch with stream processing and custom transforms. Use when loading files or batch importing data — not for reindexing, general ingest pipeline design, or bulk API patterns. | 0.2.0 | elastic |
 | [elasticsearch-onboarding](skills/elasticsearch/elasticsearch-onboarding/SKILL.md) | Help developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and building a search experience with best practices baked in. Use this when the user shows intent to build search-related functionality, asks about Elasticsearch-related concepts for their use case, or expresses the need for help getting started with Elasticsearch. | 0.1.0 | elastic |
 | [elasticsearch-security-troubleshooting](skills/elasticsearch/elasticsearch-security-troubleshooting/SKILL.md) | Diagnose and resolve Elasticsearch security errors: 401/403 failures, TLS problems, expired API keys, role mapping mismatches, and Kibana login issues. Use when the user reports a security error. | 0.1.0 | elastic |

package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.0",
+  "version": "0.3.1",
   "name": "elastic-agent-skills",
   "description": "Official Elastic agent skills for Elasticsearch, Kibana, Observability, Security, and Cloud",
   "license": "Apache-2.0",

plugins/cloud/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.0",
+  "version": "0.3.1",
   "name": "elastic-cloud",
   "description": "Elastic Cloud skills - project setup, access management, network security, and Serverless project lifecycle",
   "author": {

plugins/cloud/plugin.json

@@ -1,14 +1,21 @@
 {
+  "version": "0.3.1",
   "name": "cloud",
   "description": "Elastic Cloud skills - project setup, access management, network security, and Serverless project lifecycle",
-  "version": "0.3.0",
   "author": {
     "name": "Elastic",
     "url": "https://www.elastic.co"
   },
   "repository": "https://github.com/elastic/agent-skills",
   "homepage": "https://github.com/elastic/agent-skills/tree/main/plugins/cloud",
   "license": "Apache-2.0",
-  "keywords": ["cloud", "serverless", "elastic-cloud", "elastic"],
-  "skills": ["skills/"]
+  "keywords": [
+    "cloud",
+    "serverless",
+    "elastic-cloud",
+    "elastic"
+  ],
+  "skills": [
+    "skills/"
+  ]
 }

plugins/elasticsearch/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.0",
+  "version": "0.3.1",
   "name": "elastic-elasticsearch",
   "description": "Elasticsearch skills - ES|QL queries, data ingestion, security (authn, authz, audit), and troubleshooting",
   "author": {

plugins/elasticsearch/plugin.json

@@ -1,7 +1,7 @@
 {
+  "version": "0.3.1",
   "name": "elasticsearch",
   "description": "Elasticsearch skills for GitHub Copilot — translate natural language to ES|QL, ingest data, manage security (authn, authz, audit), and troubleshoot clusters.",
-  "version": "0.3.0",
   "author": {
     "name": "Elastic",
     "url": "https://www.elastic.co"
@@ -17,5 +17,7 @@
     "security",
     "elastic"
   ],
-  "skills": ["skills/"]
+  "skills": [
+    "skills/"
+  ]
 }

plugins/elasticsearch/skills/elasticsearch-esql/SKILL.md

@@ -6,7 +6,7 @@ description: >
   charts and dashboards from ES|QL results.
 metadata:
   author: elastic
-  version: 0.3.0
+  version: 0.4.0
 ---
 
 # Elasticsearch ES|QL
@@ -39,7 +39,7 @@ ES|QL uses pipes (`|`) to chain commands:
 >   development (next minor from main), so clients that only semver-compare may treat Serverless as “latest.” **Do not**
 >   use `version.number` to gate features: if `build_flavor` is `"serverless"`, assume all GA and preview ES|QL features
 >   are available.
-> - `build_flavor: "default"` — Self-managed or Elastic Cloud Hosted. Use `version.number` for feature availability.
+> - `build_flavor: "default"` — Stack (self-managed or Cloud-hosted). Use `version.number` for feature availability.
 > - **Snapshot builds** have `version.number` like `9.4.0-SNAPSHOT`. Strip the `-SNAPSHOT` suffix and use the
 >   major.minor for version checks. Snapshot builds include all features from that version plus potentially unreleased
 >   features from development — if a query fails with an unknown function/command, it may simply not have landed yet.

plugins/elasticsearch/skills/elasticsearch-esql/references/dsl-to-esql-migration.md

@@ -958,22 +958,22 @@ FROM sales
 
 Features not available in ES|QL as of version 9.3:
 
-| Feature                      | Query DSL | ES\|QL                                    |
-| ---------------------------- | --------- | ----------------------------------------- |
-| Highlighting                 | ✅        | ❌                                        |
-| Nested queries               | ✅        | ❌                                        |
-| Parent-child queries         | ✅        | ❌                                        |
-| Scroll/pagination beyond 10k | ✅        | ❌                                        |
-| Percolate queries            | ✅        | ❌                                        |
-| Complex boosting             | ✅        | Limited                                   |
-| Geo distance sorting         | ✅        | ❌                                        |
-| Runtime fields               | ✅        | Use EVAL                                  |
-| Suggest API                  | ✅        | ❌                                        |
-| Collapse (field collapsing)  | ✅        | ❌                                        |
-| Inner hits                   | ✅        | ❌                                        |
-| Timezone support             | ✅        | ✅ `SET time_zone` (Serverless GA)        |
-| JOIN (non-lookup)            | N/A       | ❌ (only LEFT JOIN on lookup index)       |
-| Subqueries / UNION ALL       | N/A       | ✅ `FROM` subqueries (Serverless preview) |
+| Feature                      | Query DSL | ES\|QL                                   |
+| ---------------------------- | --------- | ---------------------------------------- |
+| Highlighting                 | ✅        | ❌                                       |
+| Nested queries               | ✅        | ❌                                       |
+| Parent-child queries         | ✅        | ❌                                       |
+| Scroll/pagination beyond 10k | ✅        | ❌                                       |
+| Percolate queries            | ✅        | ❌                                       |
+| Complex boosting             | ✅        | Limited                                  |
+| Geo distance sorting         | ✅        | ❌                                       |
+| Runtime fields               | ✅        | Use EVAL                                 |
+| Suggest API                  | ✅        | ❌                                       |
+| Collapse (field collapsing)  | ✅        | ❌                                       |
+| Inner hits                   | ✅        | ❌                                       |
+| Timezone support             | ✅        | ✅ `SET time_zone` (9.4+ GA; Serverless) |
+| JOIN (non-lookup)            | N/A       | ❌ (only LEFT JOIN on lookup index)      |
+| Subqueries / UNION ALL       | N/A       | ✅ `FROM` subqueries (9.4+; Serverless)  |
 
 ### Unsupported Field Types in ES|QL
 

plugins/elasticsearch/skills/elasticsearch-esql/references/environment-setup.md

@@ -7,8 +7,8 @@ successful connection test.
 > **Elastic Cloud Serverless:** After connecting, inspect `GET /`. If `build_flavor` is `"serverless"`, do **not** use
 > `version.number` to decide which ES|QL features are allowed — Serverless tracks current GA and preview ES|QL, and the
 > reported version follows the main-line / next-minor line (semver-only clients may see it as “latest”). Prefer
-> `build_flavor` for detection and gating. For the full rules (including self-managed and snapshot builds), read
-> **Cluster Detection** in [SKILL.md](../SKILL.md) and the **Serverless** callout in
+> `build_flavor` for detection and gating. For the full rules (including Stack and snapshot builds), read **Cluster
+> Detection** in [SKILL.md](../SKILL.md) and the **Serverless** callout in
 > [ES|QL Version History](esql-version-history.md).
 
 ## Option 1: Elastic Cloud (recommended for production)