kibana-streams

Kibana Streams are an experimental way to manage data in Kibana, and this skill drives their REST API for read and lifecycle work without touching mutating operations like create, update, delete, or fork. It reads stream metadata and definitions, ingest and query settings, the queries attached to a stream, significant events, and attachments such as linked dashboards, rules, and SLOs. On the lifecycle side it can enable, disable, and resync streams through the dedicated POST endpoints. Requests go to <kibana_url>/api/streams, or the space-scoped /s/{space_id}/api/streams path when working outside the default space, and authenticate with an API key or basic auth. Read operations need the read_stream privilege while lifecycle calls need manage_stream; mutating lifecycle endpoints also require the kbn-xsrf: true header. A dedicated focus is retention: ingest settings expose both a stream lifecycle (ingest.lifecycle, using lifecycle.dsl.data_retention such as 30d, or lifecycle.inherit for child streams) and a separate failure store lifecycle that governs only failed documents. When someone asks to set or change retention, the skill targets the stream's main data retention rather than the failure store unless failed documents are explicitly mentioned. Because the API and its behavior are still experimental, callers should expect changes over time and consult the official Streams API operation pages for exact request and response bodies. Safety guidance is built in around the disable operation: disabling wired streams deletes their data (classic stream data is preserved), so the skill warns and asks for confirmation before proceeding. It favors read operations when the user only needs to inspect stream state, reserving lifecycle APIs for cases that genuinely require enabling, disabling, or resyncing. Endpoint and parameter detail lives in the bundled streams API reference.