Fleet UI - Runtime Field

Elastic Stack Elastic Agent
1

Hello,
I am working on my own fleet custom dashboard and noticed that the Status field like "Unhealthy" , "Healthy", "Offline", etc are not added to the .fleet-agents-* index.
Is there any logic or perhaps a runtime field I can add to include the status?

2

Hello,

I have created a runtime field to display a fleet.status field
long currentTimeMillis = System.currentTimeMillis();

      if (doc['unenrolled_at'].size() > 0) {
        emit('Unenrolled');
        return;
      }
      
      if (doc['last_checkin'].size() > 0) {
        long lastCheckinMillis = doc['last_checkin'].value.toInstant().toEpochMilli();
        // Consider an agent offline if it hasn't checked in for more than 5 minutes
        if (lastCheckinMillis < currentTimeMillis - 300000) {
          emit('Offline');
          return;
        }
      }
      
      if (doc['last_checkin_status'].size() > 0) {
        String status = doc['last_checkin_status'].value;
        if (status == 'online') {
          emit('Healthy');
        } else if (status == 'error') {
          emit('Unhealthy');
        } else if (status == 'updating') {
          emit('Updating');
        } else if (status == 'DEGRADED') {
          emit('Unhealthy');
        } else if (status == 'starting') {
          emit('Updating');
        } else {
          emit('Unknown');
        }
      } else {
        emit('Unknown');
      }

I was then able to create a custom dashboard using that same index:

image
image1892×940 169 KB

3

Glad you were able to come up with something you're happy with.

You can view the logic Fleet uses to populate the status field here kibana/x-pack/plugins/fleet/common/services/agent_status.ts at main · elastic/kibana · GitHub

For example, the "Updating" status in the Fleet UI is any of '(status:updating or status:unenrolling or status:enrolling)'

1 Like