Elastic Fleet: Alert on Agent Status

jsanz · May 29, 2023, 4:11pm

Hi @DougR , thanks for posting. Unforutanetly I think there is not such functionality in Kibana. I found this feature request by @Jeff_Vestal

github.com/elastic/kibana

Provide Kibana Alerting functionality for Fleet

opened 04:07PM - 02 Oct 20 UTC

jeffvestal

Team:Fleet

**Describe the feature:** As an administrator responsible for managing Elastic …Agents with Fleet, I would like to easily enable alerting to be notified when an agent goes offline. Ideally I would be able to configure this with a Kibana Alerting flyout within the Fleet UI. **Describe a specific use case for the feature:** With the elastic agent being centrally managed within Kibana, it is important for end users to know when one or more of the agents goes offline. We have other indicators down the line (eg. log rate drop offs) but operators/administrators need to be able to configure alerting for offline agents regardless of the modules they are running. Currently there is only a visual indication when you navigate to Ingest Manager -> Fleet (screenshot below). Without OOTB alerting functionality we risk missing data, affecting other Solutions, and affecting business disruptions for use cases that rely on timely delivery of data through our pipeline. <img width="1369" alt="Fleet UI - Agent offline" src="https://user-images.githubusercontent.com/53237856/94944151-70dfef80-049e-11eb-9e99-a9ac27c1c8b5.png"> cc: @mukeshelastic

You can create rules based on your agent writes (like the System integration writing at the logs-* data stream with data_stream.dataset: elastic_agent) but I concur that is not ideal.

Example of a single agent writing data in the logs-* data view, filtering to show activity from the agent itself, filebeat and metricbeat