This is the default behavior of X-Pack monitoring (and it always has been FYI). The way the nodes list is two-fold:
- We select the latest
node_stats document reported from every node in the cluster within the selected time range. If a node is offline, then its "latest" report is inherently outdated.
- We compare nodes to the latest cluster state's node list (from the latest
cluster_stats document in the data). If a node does not appear in this list, but we find data for it, then we mark it as Offline.
Once nodes have been offline for longer than the selected time range (e.g., 1 hour) then we do not "see" them and therefore we do not list them. Due to how it works by looking for data, there is no setting to change this behavior.
If you are able to use Cluster Alerts, then we will provide a cluster alert whenever a node is started, stopped, or restarted.
Hope that helps,