Elastic Agent Builder
by Elastic N.V.
Build enterprise AI agents grounded in Elasticsearch data, with MCP, A2A and rule-based workflows
Elastic Agent Builder is a platform for building and running AI agents grounded in enterprise data already indexed in Elasticsearch. It bundles data ingestion, retrieval and ranking, built-in and custom tools, skills, a chat interface, agent observability and rule-based Workflows into one product, so teams doing context engineering do not have to assemble a retrieval stack from separate vendors.
Elastic Agent Builder is Elastic N.V.'s agent development platform, introduced 21 October 2025 and made generally available on 22 January 2026. It sits on top of Elasticsearch and treats context engineering — not model choice — as the hard problem in production agents, bundling native data prep and ingestion, retrieval and ranking, built-in and custom tools, a conversational interface and agent observability into a single product. Agents are defined as LLMs with custom instructions and an assigned tool set that select tools and arguments through an iterative reasoning loop; they can also be given skills, which are reusable instruction sets encoding specialised expertise. Custom tools are authored in ES|QL, Elastic's query language, and external systems are reached through native MCP and A2A support, with a Kibana-based Agents API for programmatic management. Agent Builder is model-agnostic across the major cloud providers' model services and integrates with Microsoft Foundry and Agent Framework, LlamaIndex and Arcade.dev. Elastic Workflows, announced in tech preview alongside GA, reached general availability in Elastic 9.4 on 5 May 2026; it adds rule-based orchestration so agents execute predictably across systems rather than relying entirely on LLM planning. Chief Product Officer Ken Exner framed the pairing as agents that 'reason accurately and execute predictably.' The 9.4 release also added Skills, in-chat interaction with Kibana dashboards and queries, a semantic metadata layer and improved multi-turn context management, and turned Agent Builder on by default across all deployment types. Elastic, founded in 2012 by Shay Banon, Steven Schuurman, Uri Boness and Simon Willnauer, trades as NYSE: ESTC, employs roughly 3,400 people and cites Docusign, PepsiCo and UOL as Agent Builder customers.
A platform or data engineering team already running Elasticsearch at scale for search, observability or security, that now needs production agents grounded in that same index rather than a parallel vector store.
Agents reach enterprise data through governed ES|QL tools and MCP instead of bespoke integrations, and Workflows gives them rule-based execution so multi-system actions are predictable rather than LLM-planned.
At a Glance
- Category
- AI Agents & Orchestration
- Pricing
- Usage-based, Subscription, Contact for pricing
- Target Market
- CIOs, CTOs, Enterprise Developers, Platform Engineering Teams, Security Operations
- Deployment
- Cloud-first, Self-hosted, Hybrid, Multi-cloud, API-based
- Founded
- 2012
- Headquarters
- Amsterdam, Netherlands
- Team Size
- 500+
- Customers
- Elastic powers search, security and observability for over half the Fortune 500; Docusign, PepsiCo and UOL are named on the Agent Builder page
Key Features
- ✓Custom agents with skills
Agents combine custom instructions, an assigned tool set and reusable skill packages encoding specialised task expertise.
- ✓ES|QL custom tools
Developers author retrieval and action tools in Elastic's query language and expose them to agents directly.
- ✓Native MCP and A2A support
Standards-based protocols connect external data sources and other agents without proprietary per-vendor connectors.
- ✓Elastic Workflows
Rule-based orchestration, generally available in 9.4, executes multi-system actions predictably instead of relying on LLM planning.
- ✓Agent observability
Built-in tracing and evaluation show which tools an agent called and why a run behaved as it did.
- ✓Model-agnostic connectors
Works across major cloud providers' model services, with dynamic LLM connectors adding new models between Elastic releases.
- ✓Agent Chat and Agents API
Users query agents in natural language in the UI or manage them programmatically through the Kibana Agents API.
Capabilities
Use Cases
- •Grounded enterprise search agent
A support organisation exposes ticket, order and policy indices as ES|QL tools so an agent answers using the customer's actual state rather than static documentation.
- •Security alert triage
Security teams apply purpose-built agent skills for alert triage, detection authoring, entity investigation and threat hunting against data already in Elastic Security.
- •Agentic Kubernetes observability
An SRE team runs automated alert-to-root-cause investigation workflows that traverse logs, metrics and traces without a human assembling the query chain.
- •Natural-language dashboard creation
An analyst describes the visualisation they want and the agent generates the corresponding Kibana dashboard and underlying ES|QL queries.
- •Cross-framework agent integration
A development team wires Elastic-grounded agents into Microsoft Foundry, LlamaIndex or Arcade.dev pipelines using the native MCP and A2A endpoints.
Ideal For
Best For
- ✓Teams with large existing Elasticsearch estates who want agents grounded in indexed data without standing up a separate retrieval stack
- ✓Building governed retrieval tools in ES|QL that expose only the data and fields an agent is permitted to see
- ✓Connecting agents to external systems and other agents over standards-based MCP and A2A rather than proprietary connectors
- ✓Observability and security operations that need agent skills for alert triage, detection authoring, entity investigation and threat hunting
- ✓Multi-system automation where deterministic, rule-based Workflows must run alongside LLM reasoning
Not Ideal For
- ✗Organisations not already invested in Elasticsearch — the value proposition is retrieval quality over data you have already indexed, and adopting the Elastic Stack purely to get Agent Builder is a large detour
- ✗Elastic Cloud Hosted and self-managed customers below the Enterprise tier, since Agent Builder is gated to that tier outside Serverless
- ✗Teams needing streaming A2A interactions or human-in-the-loop prompts inside standalone sub-agent executions, both of which the documentation lists as unsupported
- ✗Workloads whose tools return very large payloads, which the known-issues page flags as a common cause of context-length failures
Integrations
Deployment
Market & Ratings
Elastic powers search, security and observability for over half the Fortune 500; Docusign, PepsiCo and UOL are named on the Agent Builder page
Market Analysis
Pros
- ✓Retrieval quality comes from Elasticsearch itself, which is a mature ranking and search engine rather than a vector index bolted onto an agent framework
- ✓Standards-first on MCP and A2A and model-agnostic across cloud providers, which keeps the agent layer from becoming a hyperscaler lock-in decision
- ✓Workflows reaching general availability in 9.4 closes the common gap where agents reason well but execute unreliably across systems
- ✓Available self-managed and on-premise, an option the competing hyperscaler agent platforms do not offer
- ✓Consumption pricing on Serverless includes a genuine free allowance — 1,000 agent executions and 10,000 workflow executions — before metering starts
Cons
- ✗Outside Serverless, Agent Builder is gated behind the Enterprise tier of Elastic Cloud Hosted or a self-managed Enterprise subscription, so smaller Elastic customers cannot reach it without an upgrade
- ✗Elastic's own limitations page documents that the A2A server does not support streaming, human-in-the-loop prompts do not work in standalone sub-agent executions, and cross-cluster search needs explicit remote patterns
- ✗Known issues include context-length failures when tools return large responses, SQL being misinterpreted as ES|QL by the default agent, and Claude 4.6 Sonnet generating invalid ES|QL for dashboard workflows unless a higher-tier model is used
- ✗Tools are authored in ES|QL, so the platform assumes existing Elastic query expertise rather than being framework-agnostic for developers
- ✗Constellation Research characterised the 2025-2026 wave of vendor 'context' messaging as a coordinated chorus, and Elastic is squarely part of it — the positioning is not differentiated by narrative alone
- ✗Built-in Observability and Threat Hunting agents were removed in version 9.4, so anyone who standardised on them has to rebuild as custom agents
Pricing
Elastic Cloud Serverless (consumption)
From $0.09/VCU-hour search
- ✓Agent Builder: 1,000 executions free, then from $0.025 each
- ✓Workflows: 10,000 executions free, then from $0.0108 each
- ✓Ingest VCU from $0.14/hour
- ✓ML VCU from $0.07/hour
- ✓Storage from $0.047/GB retained per month
- ✓Elastic Managed LLM at $4.50 per million input and $21 per million output tokens
Elastic Cloud Hosted — Enterprise tier
Contact for pricing
- ✓Agent Builder included at Enterprise tier only
- ✓Resource-based pricing, pay-as-you-go monthly or prepaid
- ✓Four support tiers
Self-managed — Enterprise subscription
Contact for pricing
- ✓Agent Builder included at Enterprise tier
- ✓Licence priced by nodes and RAM
- ✓Run in your own datacentre or cloud account
There is no standalone price for Agent Builder — it rides on the Elastic Cloud subscription. On Serverless it is consumption-metered with 1,000 agent executions free and then from $0.025 per execution, alongside separate VCU rates for ingest ($0.14/hr), search ($0.09/hr) and machine learning ($0.07/hr), storage at $0.047/GB-month, and token charges if you use the Elastic Managed LLM at $4.50 per million input and $21 per million output tokens. Workflows gets 10,000 free executions then from $0.0108 each. On Elastic Cloud Hosted and self-managed deployments Agent Builder is gated behind the Enterprise tier, which is quote-only and resource- or node-priced, so the real cost is an Enterprise upgrade rather than an agent line item. A free trial is available; there is no perpetual free tier for the cloud service.
Security & Compliance
Connect
Sources
This page was written from 8 sources, 3 on domains other than elastic.co.
- 1.elastic.co — agent buildervendor
- 2.elastic.co — agent builder agentsvendor
- 3.elastic.co — limitations known issuesvendor
- 4.elastic.co — serverless searchvendor
- 5.elastic.co — whats new elastic 9 4 0vendor
- 6.barchart.com — elastic announces general availability of agent builder with
- 7.constellationr.com — welcome context chorus theres no ai without context
- 8.en.wikipedia.org — Elastic NV
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Resolve AI
AI agents that take production on-call, investigate incidents across code and telemetry, and act inside your guardrails
Sema4.ai
Enterprise AI agents for knowledge work, running natively in your Snowflake or cloud account
Sapiom
Agent infrastructure that routes, runs and meters AI agents in production
Itential FlowAI
Governed AI agents for network and infrastructure operations, with deterministic execution and full audit trails