Elastic Content Share

Get content for Kibana, Elasticsearch, Logstash and more

Elastic Content Share

Elastic Workflows Root Cause Analysis RCA

Start an incident from evidence instead of a blank chat. This RCA workflow uses Agent Builder to investigate observability alerts, create a case, and attach the reasoning trail so engineers can review the likely cause faster.

Elastic Workflows Root Cause Analysis RCA thumbnail image



When an observability alert fires, engineers often spend the first minutes gathering the same context: service, alert window, traces, logs, metrics, previous healthy behavior, and case notes. This package provides a reusable Kibana Workflow that turns that repeated investigation path into a structured RCA flow powered by Elastic Agent Builder.

What is included

  • root-cause-analysis-rca-workflow.yaml from elastic/workflows.
  • Observability examples README.
  • Apache 2.0 license and Elastic Workflows NOTICE file.

Who it helps

Use this workflow when your team wants faster first-pass incident analysis without giving up human review. The workflow asks Agent Builder to investigate the alert, generates case-ready text, attaches alert context, and records the reasoning so responders can validate the evidence instead of reconstructing the investigation from scratch. It is a strong starting point for SRE teams building human-approved automation around latency regressions, error spikes, and service degradation.

Compatibility

The Labs article lists Elastic Cloud or self-managed Elastic Stack 9.4+ as the prerequisite.

Source and license

Source is from elastic/workflows and is licensed under Apache 2.0.

Download Now
Tested versions
ECS compliant

You must log in to submit a review.