Elastic teams usually know what they want to achieve before they know the exact query, dashboard, alert rule, or incident handoff they need. FlexiClaw for Elastic starts at that point: operational intent.
Version 0.4 moves FlexiClaw beyond a dashboard demo. It turns Codex into a practical SRE agent for Elastic observability: the user asks in natural language, FlexiClaw inspects the connected Elastic environment, builds evidence, chooses the right workflow, and keeps governed writes behind review, approval and verification.
01What 0.4 can do today
The 0.4 surface is focused on Elastic observability operations. It is not full Elastic administration, and it is not an autonomous remediation bot. It is an evidence-first agent layer for the repetitive work around incidents, daily checks, dashboards, alerts, reports and operational memory.
02The SRE loop
The important product shift in 0.4 is that the skills are no longer isolated utilities. FlexiClaw can move through an operational loop: check memory for similar incidents, investigate live Elastic signals, write a Case File, create a dashboard when useful, propose alerts when the evidence supports it, write a report, then turn reviewed incident knowledge into reusable memory.
That is the difference between a command wrapper and an agentic operating layer. The user does not need to know which script, query or artifact comes next. The user can ask operationally: "what changed?", "is this alert real?", "how is my platform today?", or "build a dashboard from what you see."
03The safety contract
FlexiClaw is intentionally conservative around writes. Local credentials stay out of chat. Investigation, health reports, integration advice, dashboard previews and alert triage are read-only or local-artifact workflows.
When a workflow can create something in Elastic or Kibana, the product uses a plan-first model: preview the plan, require explicit approval, execute only the approved action and verify before claiming success. That applies to Kibana Lens dashboards, FlexiClaw-tagged alert rules and derived RAG indices.
Evidence and guesses never get mixed. FlexiClaw can explain what the data supports, what is still a hypothesis, which historical memory is only context, and what should be checked next.
04Where it fits beside Kibana
Kibana remains the native Elastic workbench for exploration, dashboards, APM and operational management. FlexiClaw for Elastic sits beside it as the intent-driven agent surface: it helps Codex decide what to inspect, what evidence matters, which output is worth creating and whether the approved output actually exists.
05Current boundaries
FlexiClaw for Elastic 0.4 does not perform automatic remediation. It does not replace Kibana or the native Kibana APM app. It does not claim full Elastic coverage, Elastic Security-specific workflows, cluster setting changes, ILM changes, template changes, data stream modification, Fleet writes, connector creation, notification actions, or modifying and deleting existing alert rules.
RAG from existing Elastic indices is supported only through the governed path: a capped source read, no source-index modification, a derived FlexiClaw-owned target index, explicit approval and verification.
Try the 0.4 product surface
The main FlexiClaw page focuses on FlexiClaw for Elastic: the Codex plugin for Elastic observability, SRE checks, dashboards, alert triage, Case Files, RAG and verified outputs.