Skip to main content
AI Learning Resources

Quick Overview

This technical demonstration, presented by Elastic Senior Developer Advocate JP Hwang for Google Cloud Tech, shows how to build a custom observability AI agent and expose it to Gemini Enterprise. It walks through diagnosing application performance regressions using live telemetry and configuring cross-platform agent communication.

Key Points

  • 1.Elastic Agent Builder enables developers to create specialized AI agents equipped with tools and skills such as investigation runbooks.
  • 2.Observability data including logs, metrics, and traces can ground an AI agent to automatically detect and isolate system regressions.
  • 3.Agents created in Elastic Agent Builder can be configured via a graphical interface or programmatically through an API.
  • 4.The Agent-to-Agent protocol allows custom Elastic agents to be registered and invoked directly within Gemini Enterprise.
  • 5.Authentication currently uses an intermediate proxy on Cloud Run to manage API keys, with plans to support OAuth in the future.

Summary

The demonstration opens with an e-commerce retail web application that is experiencing slow image loading times. To identify the root cause without manual troubleshooting, the system exports live logs, metrics, and traces directly into Elastic Observability. A specialized assistant named the Astronomy Shop Incident Investigator is created using Elastic Agent Builder to automate performance incident diagnosis.

Elastic Agent Builder configures the agent with specialized tools and operational skills. The provided tools execute specific diagnostic functions, such as identifying latency regressions, pulling representative slow traces, and summarizing related errors. Alongside these tools, a custom investigation runbook is supplied as a skill, providing explicit instructions that guide the agent on when and how to invoke each diagnostic tool safely during an incident.

When asked whether there have been any recent degradations, the investigator agent queries the system telemetry and analyzes performance over time. It identifies a significant latency degradation in the front-end proxy service that matches the image loading issue. The agent provides structured evidence, including comparison windows, baseline versus current p95 latencies, sample counts, and representative trace identifiers. Expanding the execution step log reveals each tool invocation, its input parameters, and the raw ESQL queries and outputs, ensuring the entire diagnostic sequence remains fully inspectable.

Agent definitions created in Elastic Agent Builder can be managed through the graphical interface or via Kibana APIs. To make the custom agent accessible across an organization, Elastic Agent Builder supports the Agent-to-Agent protocol. This protocol generates an agent data card endpoint providing a JSON specification that outlines the agent's identity, capabilities, and communication structure.

Within Gemini Enterprise, administrators can register external agents using the Agent-to-Agent connector by providing the JSON agent card and configuring authentication. In the demonstration setup, a proxy deployed on Cloud Run manages the Elastic API key server-side and forwards incoming calls to Elastic's protocol endpoint. Once registered, the incident investigator appears inside the Gemini Enterprise interface. Submitting the degradation query within Gemini Enterprise invokes the remote Elastic agent, returning the identical evidence-backed diagnosis directly within the central workspace.

Investigating performance issues with Elastic Agent Builder

When an e-commerce demonstration application experiences slow image loading, observability telemetry such as live logs, metrics, and traces are forwarded to Elastic Observability. Instead of manually parsing this telemetry, a specialized incident investigator agent built in Elastic Agent Builder diagnoses the problem. The agent relies on custom tools for locating latency regressions, retrieving representative slow traces, and summarizing errors, guided by an investigation runbook skill.

Executing diagnostics and verifying tool execution

Prompting the agent about recent system degradations causes it to run diagnostic tools and return evidence-backed findings. In the demonstration, the agent pinpoints the front-end proxy service as the origin of the latency regression and provides corresponding trace identifiers. Users can expand the interface to inspect the specific tool calls and raw telemetry outputs, ensuring that all findings remain transparent and grounded in telemetry data.

Connecting custom agents to Gemini Enterprise via A2A

Elastic Agent Builder exposes agent definitions through the Agent-to-Agent protocol, which outputs an agent data card in JSON. By inputting this JSON configuration and setting up authentication in Gemini Enterprise, the custom agent becomes accessible alongside native enterprise AI assistants. Users can query the agent from the Gemini Enterprise web interface to trigger the exact same investigation workflows, with a temporary Cloud Run proxy safeguarding API keys until native OAuth support is released.

The Bottom Line

The video establishes a functional workflow for building telemetry-grounded incident investigation agents in Elastic and serving them directly through Gemini Enterprise. It demonstrates how runbooks and diagnostic tools give language models repeatable, inspectable paths to analyze latency regressions. The current architecture relies on a Cloud Run proxy to handle authentication, leaving direct OAuth integration as an upcoming enhancement.

FAQ

What is Elastic Agent Builder and how does it create incident investigation agents?

Elastic Agent Builder is a platform with graphical and API interfaces for creating custom AI agents. It equips agents with specialized operational tools and skills, such as investigation runbooks, to analyze telemetry data.

How does the incident investigator agent identify the source of image loading regressions?

The agent executes pre-configured tools that query live logs, metrics, and traces stored in Elastic Observability. By comparing latency percentiles across baseline and current time windows, it isolates the front-end proxy as the problematic component.

What role does an investigation runbook skill play in Elastic Agent Builder?

The investigation runbook teaches the agent the precise operational steps, safety rules, and criteria for when and how to call each diagnostic tool during an incident review.

How is a custom Elastic agent integrated into the Gemini Enterprise workspace?

The agent is exposed via the Agent-to-Agent (A2A) protocol endpoint, which provides a JSON agent card. That card is added into Gemini Enterprise through the custom agent registration interface.

Why is an intermediate proxy on Cloud Run used in the Gemini Enterprise demo?

The Cloud Run proxy securely holds the Elastic API key on the server side and forwards requests to the Elastic Agent-to-Agent endpoint until native OAuth authentication is supported.

Worth watching for

Site reliability engineers, DevOps professionals, and cloud architects looking to integrate specialized Elastic observability workflows into centralized enterprise AI interfaces like Gemini Enterprise.

  • google-cloud
  • elastic
  • gemini-enterprise
  • observability
  • ai-agents
Watch on YouTubeMore videos from Google Cloud Tech