[agent-suggestions] Agent suggestions - 2026-03-30

## Agent Suggestions
**Date:** 2026-03-30

### 1. Agentic Workflow Failure Triage
**Trigger:** `issues` (opened/edited) for titles matching `[aw] * failed` and/or label `agentic-workflows`; optional daily `schedule` for dedupe/reconciliation.

**Purpose:** Reduce recurring operational toil from agentic workflow failures by clustering duplicate failures, extracting likely root cause from run metadata, and routing maintainers to a single canonical tracker with concrete remediation steps.

**Proposed safe outputs:** `create-issue` (single canonical tracker or refresh issue), `add-comment` (on duplicate failure issues with tracker link + suggested next action), `noop` when transient/unactionable.

**Evidence:**
- Beats has multiple recent open failure issues with repeated pattern `[aw] ... failed`:
- https://github.com/elastic/beats/issues/49670
- https://github.com/elastic/beats/issues/49741
- https://github.com/elastic/beats/issues/49548
- https://github.com/elastic/beats/issues/49087
- Similar downstream signal across repos using `gh-aw-*` workflows:
- https://github.com/elastic/integrations/issues/17884
- https://github.com/elastic/integrations/issues/17880
- https://github.com/elastic/oblt-aw/issues/93
- https://github.com/elastic/oblt-aw/issues/92
- https://github.com/elastic/oblt-aw/issues/110
- Workflow adoption examples in downstream repos:
- https://github.com/elastic/integrations/blob/main/.github/workflows/trigger-pr-review.yml
- https://github.com/elastic/elastic-agent/blob/main/.github/workflows/trigger-pr-review.yml

**Why not covered already:**
Current Beats workflows cover code/PR/docs/test analysis (e.g., PR review, issue triage, duplicate issue detector, buildkite detective, bug hunter, test improver), but none focus on **meta-triaging agentic workflow failures themselves** and deduplicating recurring `[aw] ... failed` incidents into actionable runbook-style guidance.

## Duplicate Checks
- Open issues (`agent OR workflow OR automation`):
https://github.com/elastic/beats/issues?q=is%3Aopen+is%3Aissue+repo%3Aelastic%2Fbeats+%28agent+OR+workflow+OR+automation%29
- Open PRs (`agent OR workflow`):
https://github.com/elastic/beats/pulls?q=is%3Aopen+repo%3Aelastic%2Fbeats+%28agent+OR+workflow%29
- Prior suggestions in title (`[agent-suggestions]`):
https://github.com/elastic/beats/issues?q=repo%3Aelastic%2Fbeats+is%3Aissue+in%3Atitle+%22%5Bagent-suggestions%5D%22
- Previously filed suggestion issues reviewed:
- https://github.com/elastic/beats/issues/49187
- https://github.com/elastic/beats/issues/49351

## Downstream Signals
- `elastic/integrations` recurring AW failure reports:
- https://github.com/elastic/integrations/issues/17884
- https://github.com/elastic/integrations/issues/17880
- `elastic/oblt-aw` recurring AW failure reports:
- https://github.com/elastic/oblt-aw/issues/93
- https://github.com/elastic/oblt-aw/issues/92
- https://github.com/elastic/oblt-aw/issues/110

## Suggested Next Steps
- [ ] Prototype `trigger-agent-workflow-failure-triage.yml` using issue/comment-only safe outputs.
- [ ] Add dedupe key fields (`workflow_id`, `run_url`, `error_signature`) to prevent duplicate reports.
- [ ] Pilot for 2–4 weeks and measure: duplicate reduction, median time-to-first-actionable-fix.

> [!NOTE]
>
> 🔒 Integrity filtering filtered 407 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - [#49658](https://github.com/elastic/beats/issues/49658) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49754](https://github.com/elastic/beats/issues/49754) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49756](https://github.com/elastic/beats/issues/49756) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49755](https://github.com/elastic/beats/issues/49755) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49728](https://github.com/elastic/beats/issues/49728) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49678](https://github.com/elastic/beats/issues/49678) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49660](https://github.com/elastic/beats/pull/49660) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49723](https://github.com/elastic/beats/pull/49723) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49667](https://github.com/elastic/beats/pull/49667) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49765](https://github.com/elastic/beats/pull/49765) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49733](https://github.com/elastic/beats/pull/49733) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49772](https://github.com/elastic/beats/pull/49772) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49736](https://github.com/elastic/beats/issues/49736) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49721](https://github.com/elastic/beats/issues/49721) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49710](https://github.com/elastic/beats/issues/49710) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49690](https://github.com/elastic/beats/issues/49690) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - ... and 391 more items
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Agent Suggestions](https://github.com/elastic/beats/actions/runs/23744797810)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 6, 2026, 12:41 PM UTC

Read the existing .github/workflows/trigger-pr-review.yml examples in integrations and elastic-agent, then compare them with the proposed trigger-agent-workflow-failure-triage.yml. Define the issue/comment-only workflow around workflow_id, run_url, and error_signature deduplication. Done means a 2–4 week pilot with duplicate reduction and median time-to-first-actionable-fix measured.

Written by the indexing model from the issue text.