Limitations and known issues in Elastic Agent Builder

Serverless Elasticsearch Preview Serverless Observability Unavailable Serverless Security Unavailable Stack Preview 9.2.0

Elastic Agent Builder is enabled by default in Elastic Cloud Serverless for Elasticsearch projects.

However, it must be enabled for non-serverless deployments Stack Preview 9.2.0 . Refer to Get started for instructions.

In the first release of Elastic Agent Builder on serverless, the feature is only available on Elasticsearch projects.

While Elastic offers LLM connectors for many different vendors and models, not all LLMs are robust enough to be used with Elastic Agent Builder. We recommend using the Elastic Managed LLM (the default). Learn more in Using different models in Elastic Agent Builder.

The following errors suggest your selected model may not be compatible with Elastic Agent Builder:

Error: Invalid function call syntax
		

Error executing agent: No tool calls found in the response.
		

ES|QL tools are subject to the current limitations of the ES|QL language itself. For example, named parameters (?parameter_name) do not currently work with the LIKE and RLIKE operators (issue #131356).

For non-serverless deployments, ensure your cluster supports the ES|QL features you intend to use.

For a complete list of ES|QL limitations, refer to the the ES|QL limitations documentation.

The .execute_esql tool is designed only for ES|QL syntax, not other query languages.

When using SQL syntax with the default agent, it attempts to use the .execute_esql tool instead of recognizing the input as SQL.

This results in parsing errors like this:

[
  {
    "type": "error",
    "data": {
      "message": "parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}",
      "stack": "ResponseError: parsing_exception\n\tCaused by:\n\t\tinput_mismatch_exception: null\n\tRoot causes:\n\t\tparsing_exception: line 1:15: mismatched input 'WHERE' expecting {<EOF>, '|', ',', 'metadata'}\n    at KibanaTransport._request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:591:17)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:697:22\n    at KibanaTransport.request (Desktop/Dev/kibana/node_modules/@elastic/elasticsearch/node_modules/@elastic/transport/src/Transport.ts:694:14)"
    }
  }
]