observability-k8s-investigation

Investigate Kubernetes workload, node, and control-plane issues using OTel telemetry (EDOT). Use when diagnosing pod failures (CrashLoopBackOff, OOMKilled, Error), node pressure, resource exhaustion, image pull failures, admission rejections, autoscaling anomalies, or correlating K8s state with application signals. OTel ingest path only — the legacy ECS Kubernetes integration shape is out of scope.

Version

0.5.1

Compatibility

Requires the `elastic` CLI (>= 0.2) with an Elasticsearch context, and Kubernetes telemetry ingested through EDOT / the OpenTelemetry kube-stack collector into OTel-receiver-namespaced data streams. The base floor is Elasticsearch 8.11 or later, or Serverless. One query uses the `VALUES()` aggregation, which is GA on Serverless but preview from 8.14 and GA only in 9.4 on Stack; a `VALUES()`-free rewrite is given at the point of use. Alert-state lookups additionally need a Kibana context.