How to Alert When Elastic Agent Goes Offline?

Elastic Stack Kibana
1

Hi everyone,

I'm using Elastic Agent with Fleet and I can see the agent status (e.g., healthy, offline) from the Fleet → Agents UI in Kibana.

Now, I want to create an alert that triggers when an agent goes offline for more than 15 minutes. Ideally, I'd like to:

  • Automatically detect this using the agent’s status in Fleet
  • Set up an alert rule in Kibana (Stack Management → Rules)
  • Optionally get notified via email or Slack when an agent status changes to offline

I’m aware that Fleet stores metadata in the .fleet-agents and .fleet-agent-events indices, but I’m not sure what the recommended approach is for alerting on offline agents.

Can anyone from the community or Elastic team guide me on:

  1. Best practices for alerting on offline agent status
  2. Whether querying .fleet-agents directly for status: "offline" is stable and recommended
  3. Whether there's a built-in rule type or future feature planned to support this natively in Fleet

Any help, shared rule examples, or recommended methods would be greatly appreciated!

Thanks in advance :folded_hands:

1 Like
2

Hello and welcome,

Considering that Fleet unfortunately still does not have any built-in alerts for individual agents I don't think that there are any recommended approachs on how to alert on offline agents.

So you may use what works better for you.

There are nothing official, so you need to build some custom monitoring by doing queries on the fleet internal indices or using the Fleet API.

I use the Fleet API to get information about the agents and index it on a custom index, then I create alerts on the data of this custom index.

3

Thanks @leandrojmp for sharing the details.

Could you please share what is the API you are using to capture the agent details?

With this API below will be the flow?

Custom API Integration > Ingest Pipeline > Index events > on this index => Dashboard & Rules/Alerts, right?

Thanks!!

4

I'm using the Fleet API for Agent status, this one.

I do not use custom API integrations, I prefer to write a custom python script to get and write the data.

1 Like
5

Thanks for sharing your approach!
Just to clarify — are you running the Fleet API queries on a scheduled basis (like via a cron job or scheduled task), or are you using something like Watcher or another tool to handle the automation? Would love to know what’s worked best for you in terms of keeping the data up-to-date.

6

I use a python code that run via a cron job.

1 Like
7

Providing off-shelf alerting rules on agents is a high priority roadmap item for us. We should be able to show something in this regard soon. Currently what exists for agents is highlighted here: Monitor Elastic Agents | Fleet and Elastic Agent Guide [8.18] | Elastic

Unfortunately this doesn't give the user a granular alert on a per agent basis - which is what we will be addressing.

2 Likes
8

Yeah, I commented my use case on the Github issue that implemented tha alerting by count.

This has no use for us as we have user workstations as well and the number of agents will flutuate during the day.

So it was required to build a custom monitoring.

Good to know that this is coming !

1 Like