Connect OpenClaw to Kibana
Let an OpenClaw agent triage alerts, manage cases and rules, and inspect indices and Fleet in Kibana, with no credentials handed to the agent.
Kibana is the front end of the Elastic Stack: the place where logs, metrics and security events stored in Elasticsearch turn into dashboards, alerts, detection rules and cases. SRE and security teams spend their day in it, and a lot of that day is routine — checking which alerts fired overnight, opening a case for each real one, confirming an index is still being written to, and finding out which Fleet policy a noisy agent belongs to.
With Claworc’s External Connections, an OpenClaw agent can work
inside your Kibana on your behalf. You connect Kibana once through the instance settings,
Composio holds the resulting credential, and the agent gets an auto-generated
claworc-kibana skill that tells it which Kibana tools exist and how to call them. The
agent never sees a password, an OAuth token or an API key.
Tools available to OpenClaw agents
Section titled “Tools available to OpenClaw agents”Composio’s Kibana toolkit exposes 47 tools across alerting, cases, saved objects, data views, detection rules, index management and Fleet. In practice an OpenClaw agent leans on a handful of capabilities:
- Find alerts — search and aggregate detection alerts, which is how the agent finds out what fired and how often.
- Manage alerting rules — list the alerting rules that exist and create new ones.
- Open and read cases — read open cases and open new ones so investigations are tracked where the team already looks.
- Create dashboards — useful when the agent has just answered a question you will want to keep asking.
- Manage data views — list the data views (index patterns) and add new ones as indices appear.
- Inspect indices and nodes — index details and Elasticsearch node statistics for capacity and health questions.
- Browse Fleet and detection rules — see Fleet agent policies and page through detection rules.
Every action goes through a small broker running next to the agent, so the agent only needs to describe what it wants done in plain language and let the skill handle the rest.
Use cases
Section titled “Use cases”Morning alert triage
Section titled “Morning alert triage”“What fired overnight, grouped by rule, and which of it is new?” The agent searches the alerts, groups the results, compares them with the previous day and returns a short list ranked by count and severity. For anything that looks real, ask it to open a case with the alert details filled in.
Answer index and capacity questions
Section titled “Answer index and capacity questions”“Is the logs-nginx index still growing, and how much disk are the nodes using?” The
agent reads the index list and node metrics and answers with document counts, sizes and
node stats, rather than sending you to three different screens.
Keep rules and views tidy
Section titled “Keep rules and views tidy”When a new service starts shipping to a fresh index, ask the agent to create the data view, look through the existing alerting rules for an error-rate rule to copy, and create the equivalent rule for the new service. Consistent coverage, no forgotten step.
Get started
Section titled “Get started”Connecting Kibana takes three steps: an admin adds a Composio API key to Claworc’s
settings, you open the instance’s Settings tab, click + Add connection, pick
Kibana and authorize the connection. The claworc-kibana skill appears in the instance a
moment later. The full walkthrough, including the exact Composio permissions the key
needs, is in the External Connections documentation.