AI Assistant Q&A (24 Jul 2026)

AI Assistant pricing is based on token consumption rather than the number of sessions or conversations. The token costs depend on the LLM model used for the AI Assistant. For those using Elastic Managed LLM, refer to Elastic Inference Service (EIS) pricing for more details. As for the costs of conversation retention, existing conversations are stored in Elasticsearch indices and are therefore governed by index retention policies. Final retention limits may depend on deployment configuration.

The default Elastic Managed LLM currently uses Anthropic Claude Sonnet 4.6.

Users are not limited to the default model and may configure alternative models through connectors, including:

• Platform AI models
• Azure OpenAI
• Amazon Bedrock
• Other supported Singapore-hosted LLM providers

Users can switch between connectors and select the model most appropriate for their use case, requirements, and cost considerations.

There is no single answer because pricing depends on the selected model and input/output token consumption. Refer to Elastic documentation for the Elastic Managed LLM pricing (Claude Sonnet 4.6-backed). Agencies should compare these costs with Platform AI’s offerings. In some scenarios, alternative models such as Gemini Flash may provide a lower token cost.

Beyond costs, the choice of model also depends on:

• Model capability
• Hosting requirements
• Compliance requirements
• Expected workload volumes

There is no need to request for it. The AI Assistant should generally be enabled by default. If it is not visible in your deployment, try the following:

1. Go to Management > Stack Management.
2. Go to Kibana > AI Assistants.
3. Select Manage Settings for Elastic AI Assistant for Observability and Search.
4. Under AI Assistant visibility, select Observability and Search AI Assistants in other apps.

If the issue persists, raise a support request with StackOps.

The AI Assistant does not require an ML node to operate. ML features and AI Assistant capabilities are separate:

• AI Assistant uses LLMs and Kibana integrations.
• ML capabilities are used for embeddings, anomaly detection and related ML functions.

However, to enable the knowledge base functionality, an ML node is required because embeddings must be generated for the imported documents and contextual data.

AI Assistant is built into Kibana and primarily uses Elastic Managed LLM or configured external LLMs. ML capabilities are not required for AI Assistant core functionality.

ML nodes become relevant when implementing knowledge bases, embedding generation, or context enrichment for Retrieval-Augmented Generation (RAG)-style experiences.

Yes, knowledge bases are specifically designed to provide domain and organization-specific context that does not exist in telemetry data. Examples include:

• Escalation procedures
• Runbooks
• Duty rosters
• Contact lists
• Jira content
• Confluence pages
• GitHub content
• Internal documentation

This allows AI Assistant to incorporate business and operational context into troubleshooting and RCA activities.

StackOps currently does not provide preloaded knowledge bases. However, the StackOps team will assess and consider this as part of future product planning. In the meantime, agencies with specific use cases or requirements are encouraged to reach out to StackOps Support for guidance on the available capabilities and recommend suitable approaches based on their needs.

Attack Discovery is already available and can be accessed from Security > Attack Discovery.

Elastic Agent Builder is currently not available in StackOps. It is planned for availability with StackOps Elastic Serverless.

The AI Assistant follows the same troubleshooting principles used by experienced operators:

• Form hypotheses based on alerts.
• Gather evidence from logs, metrics and traces.
• Eliminate unlikely causes.
• Correlate telemetry signals.
• Narrow findings until the most likely root cause remains.

The AI Assistant performs multi-step reasoning and actively executes Elastic queries to gather supporting evidence rather than generating responses solely from prompts. This helps accelerate Root Cause Analysis (RCA) by correlating information across telemetry sources.

Current StackOps versions do not support automatic alert closure by the AI Assistant. However, you can use Attack Discovery to triage alerts and summarise potential threats.

Future StackOps Elastic Serverless capabilities are expected to support:

• Workflows
• Automated actions
• Alert management orchestration
• Scheduled remediation processes

AI Assistant grounds its responses using:

• Elasticsearch queries
• Telemetry data (Logs, Metrics & Traces)
• Metadata collected from monitored systems
• Knowledge Base

The AI Assistant is designed to augment human investigations, not replace them. It is recommended that you:

• Validate AI findings before taking action.
• Review supporting evidence.
• Compare recommendations against operational knowledge.
• Maintain human oversight during incident analysis and RCA activities.

AI can make mistakes and users should always verify recommendations before acting.

No, there is no available option to pause or prevent automatic scrolling during AI reasoning display.

AI Assistant conversations are stored as Elasticsearch indices and follow index retention policies, which depends on your deployment configuration and index lifecycle management settings.

Yes, AI Assistant can be triggered programmatically using Elastic Inference endpoints.

When connectors are configured, corresponding inference endpoints are created and can be used for API-driven invocation and integration scenarios.

There are multiple ways StackOps AI Assistant can complement Jira Service Management (JSM):

• JSM information such as incident history can be used as a knowledge base to provide additional context.
• Events from JSM or external systems can potentially trigger Elastic AI Assistant via API.
• AI Assistant API can be integrated into incident management processes for various purposes.

Because JSM can be used in many ways, the recommended approach depends on the specific use case and integration requirements.

Currently, AI Assistant can help generate:

• ESQL queries
• KQL queries
• Detection rule logic
• Rule creation guidance

However, it does not automatically create alert rules on behalf of users. Users must manually review and create the rules.

Future StackOps Elastic Serverless capabilities, including Workflows and Agent Builder, are expected to provide more automation for alert creation and follow-on actions.

Currently there is no connector available for GitLab in StackOps Elastic. You can make use of Elastic Agent Integrations to send your data to StackOps Elastic.

Current StackOps versions do not provide this capability directly through AI Assistant. Future StackOps Elastic Serverless functionality will introduce:

• Elastic Workflows
• Scheduled automation
• Recurring analysis jobs
• Triggered operational workflows

These capabilities are expected to support scheduled tasks and automated reporting scenarios.

Attack Discovery can be scheduled to generate summaries and send results via email. However, automatically completing a full Incident Response (IR) template is currently limited. Future StackOps Elastic Serverless capabilities, including Workflows and Agent Skills, are expected to provide significantly more flexibility for report generation and incident-response automation.