AI Search + ES Agent Builder: Best Practices for Deploying Enterprise AI Assistants

Large language models are powerful, but they often lack access to internal enterprise data such as logs, documents, metrics, and incident histories. Retrieval‑augmented generation (RAG) can fill part of the gap, yet building a full data pipeline—data ingestion, vectorization, permission control, query generation, and conversational UI—requires extensive engineering effort.

ES Agent Builder addresses this problem by directly connecting existing Elasticsearch data to a large model’s understanding and reasoning capabilities. Users can ask natural‑language questions and receive readable conclusions and actionable recommendations without writing queries or constructing a separate AI stack.

Three High‑Value Scenarios

Log Analysis Assistant : Engineers ask questions like “Which API was the slowest in the past hour?”; the Agent automatically selects relevant indices, generates an ES|QL query, performs aggregation and anomaly detection, and summarizes key metrics.

Knowledge Q&A Assistant : Product documents, FAQs, operation manuals, and incident cases are indexed in ES. The Agent first retrieves the most relevant material via RAG, then lets the model generate answers, reducing keyword‑search effort and preventing hallucinations.

Operations Troubleshooting Assistant : When an alarm triggers, the Agent explains the alarm, correlates logs, metrics, traces, and historical incidents, diagnoses possible causes, and suggests next‑step actions, turning individual expertise into reusable knowledge and shortening MTTR.

Architecture Overview – Three Layers × Four Components

Data Layer : Alibaba Cloud Elasticsearch stores logs, documents, metrics, alarms, and business records, providing real‑time, trustworthy, searchable context. Access control ensures results are reliable and auditable.

Model Layer : Supports AI Search Open Platform models, Bailei AI models, and custom Inference API models. The model interprets natural‑language intent, plans analysis steps, and synthesizes retrieved data into answers.

Analysis Execution Layer consists of:

Agents : Understand user goals, decompose tasks, and decide whether the request is a log analysis, knowledge query, or troubleshooting case.

Tools : Connect to ES, execute retrieval, aggregation, or external actions, converting model reasoning into concrete data operations.

Skills : Encapsulate domain‑specific procedures (e.g., API latency investigation steps) so different Agents can reuse consistent workflows.

The full loop is: User question → Model reasoning → Tool invocation → Enterprise data → Structured conclusion.

Five Core Capabilities

Automatic NL → ES|QL conversion : Users ask in Chinese; the Agent identifies the relevant index, generates the ES|QL query, runs it, and translates the structured result into a readable conclusion, eliminating the need to know field names or query syntax.

Built‑in toolset : Tools like platform.core.search automatically discover data sources, select target indices, and decide between full‑text search, aggregation, or time‑series analysis.

Skills for knowledge capture : Skills store step‑by‑step analysis procedures (e.g., “check RT distribution → check error rate → trace upstream services”) enabling consistent, repeatable troubleshooting.

Multi‑model flexibility : Via AI Connector the builder can use OpenAI‑compatible APIs, Alibaba Cloud AI Search models (e.g., qwen‑turbo, qwen‑plus, qwen3‑max), or custom inference services, balancing latency and reasoning depth per scenario.

Result auto‑visualization : Numerical results are automatically rendered as bar or line charts within Agent Chat, removing the need for separate dashboards.

Practical Best Practices

Data quality first : Ensure index mappings define correct field types, use a unified @timestamp field, and adopt clear naming conventions for business fields.

Tool usage : Add clear aliases for heavily used indices, and for complex multi‑index analyses wrap standard queries in custom Tools to reduce the Agent’s reasoning load.

Leverage Skills : Encode common analysis flows as Skills, create separate Skills per business domain, and regularly review Agent answers to update Skills with new patterns.

Model selection : Use qwen‑turbo for high‑frequency simple log aggregation, qwen‑plus for complex semantic Q&A, and qwen3‑max for multi‑step troubleshooting.

Permission & security : Assign a dedicated ES read‑only user to the Agent, and evaluate sensitive indices (e.g., PII) before inclusion or apply field‑level security.

Integration : Embed Agent capabilities via REST API, A2A protocol, or MCP to connect with existing ops platforms, IM tools, CMDB, notification systems, and ticketing workflows.

Example Workflow

Question: “Analyze historical requests and find the API with the lowest RT.”

Agent identifies the task as API performance analysis.

Agent calls platform.core.search to locate the api_access_logs index.

Agent auto‑generates an ES|QL query that groups by API name, computes average RT, max RT, request count, and orders by average RT ascending.

The query runs, returning structured data.

Agent summarizes: the API getUserInfo has the lowest RT (120 ms) and produces a comparative bar chart for all APIs.

The result is not just raw data but a concise conclusion, visualization, and actionable insight, demonstrating how the model stays grounded in real‑time, trustworthy enterprise data.

Key Takeaways

Data as context : Directly retrieve and analyze logs, documents, metrics, and alarms from ES.

Tools as capability : Built‑in and custom tools turn reasoning into concrete actions.

Low‑barrier construction : UI or API lets users create Agents, Tools, and Skills without deep ES knowledge.

Extensible integration : Supports MCP, A2A, REST API for embedding into existing systems.

Secure and trustworthy : Inherits Elasticsearch’s access control and auditability.

Cloud‑hosted : Leverages Alibaba Cloud ES for instance reuse, Kibana, networking, and elasticity, reducing operational cost.

Overall, ES Agent Builder is more than an AI chat front‑end; it unifies enterprise data, model inference, tool execution, and cloud hosting to enable cost‑effective, reliable, and extensible intelligent assistants.