One-off — RAG & MCP

One-off: RAG & MCP

Presenter: Specialist (DSR)

Date: TBD

SLB × Elastic Workshop Program

Overview

Hands-on overview of RAG patterns and MCP tooling with Elasticsearch.

Where this applies

These labs run on Observability Serverless — a fully managed project so you can practice without cluster operations.

The same capabilities you explore here — ES|QL, Streams, AI Assistant, Agent Builder, Workflows, and SLOs — are available on Elastic Cloud Hosted (ECH) and self-managed deployments.

Serverless mainly saves operational toil (sizing, ILM, Fleet, upgrades). Your observability skills transfer directly.

Session topics

  • Retrieval-augmented generation with Elasticsearch
  • Model Context Protocol (MCP) integrations
  • Building agent workflows on Elastic data

Why these features?

🔗RAG & MCPAgents grounded in SLB knowledge and live data
🤖Agent BuilderRepeatable AI workflows with guardrails
⌘ES|QLOne query language for logs, metrics, and traces

Use → to see why each feature matters for SLB.

Why RAG & MCP?

Agents grounded in SLB knowledge and live data

Without it

LLMs hallucinate runbooks; engineers paste Confluence into chat every incident.

With RAG & MCP

Retrieval-augmented generation pulls from Elasticsearch indices; MCP exposes ES|QL, streams, and alerts as agent tools.

  • Answers cite your docs and telemetry, not the open internet
  • Standard tool interface for custom SLB integrations
  • Build "what changed?" agents without bespoke glue code
Question
Retrieve
Tool call

Why Agent Builder?

Repeatable AI workflows with guardrails

Without it

Ad-hoc ChatGPT sessions with no access to SLB data, no audit trail, and inconsistent answers per engineer.

With Agent Builder

Build agents that use observability context, tools, and retrieval — tuned prompts your team can trust and share.

  • Standardize "investigate service X" and "summarize deploy" playbooks
  • Connect tools (ES|QL, alerts, docs) instead of copy-paste context
  • Govern who can publish agents — architecture-friendly AI ops
Agent
Tools + data
Action

Why ES|QL?

One query language for logs, metrics, and traces

Without it

Different syntax per signal — PromQL for metrics, LogQL for logs, trace UI only — context switching slows incidents.

With ES|QL

ES|QL pipes data through filters, stats, and joins across observability datasets in Logs Explorer and Dev Tools.

  • Faster investigations with reusable query patterns
  • Same syntax in Logs Explorer on Serverless, ECH, and self-managed
  • AI Assistant can draft and explain ES|QL for your team
FROM logs-*
STATS / WHERE
Answer

Hands-on lab

Your lab uses Elastic Observability Serverless for a zero-ops learning environment.

The steps and features are the same on ECH and on-prem — follow the assignment panel when Kibana opens.

Instruqt track: slb-one-offs

Resources

  • Registration: events.elastic.co/slbworkshops
  • Repo: github.com/poulsbopete/slb-workshops
  • Use ← → arrow keys to navigate slides