elastic / elastic/docs-content
Document logs-elastic_agent.status_change data stream and out-of-the-box alert templates (9.3+)
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 116
Description
## Summary
Starting in 9.3.0, Fleet and Elastic Agents produce a new data stream — `logs-elastic_agent.status_change` — that is currently undocumented. At the same time, 9.3.0 introduces the concept of **alerting rule templates** installed as integration assets, which use this data stream. Neither feature is documented in the public docs.
## What's missing
### 1. `logs-elastic_agent.status_change` data stream
The data stream records agent status change events (healthy → unhealthy, upgrades, unenrolled, etc.). It is produced by Fleet & Elastic Agents starting in 9.3.0 and can be used to build custom alerts.
Currently, the [Monitor Elastic Agents](https://elastic.co/docs/reference/fleet/monitor-elastic-agent) and [Elastic Agent data streams for Fleet](https://elastic.co/docs/reference/fleet/data-streams) pages only document two internal Fleet data streams for agent status monitoring:
- `metrics-fleet_server.agent_status-default`
- `metrics-fleet_server.agent_versions-default`
`logs-elastic_agent.status_change` should be documented alongside these (or in a dedicated section), including:
- What events it captures (status changes: healthy/unhealthy/upgrading/unenrolled/…)
- Available fields
- How to use it to build custom alerts
### 2. Kibana Alert Templates installed as integration assets (9.3.0+)
Starting in 9.3.0, Elastic Agent integrations can ship with **alerting rule templates** installed alongside other integration assets (index templates, ingest pipelines, etc.). Templates can be accessed from **Kibana › Stack Management › Rules › Create Rule**, then selecting a Template.
This is a new concept — alerting templates as first-class integration assets — that has no public documentation.
Documentation should cover:
- What alerting rule templates are and how they differ from regular rules
- How to browse and use templates from the Create Rule UI
- Which integrations ship with templates (or note that not all do)
- The out-of-the-box alert templates for Elastic Agent status changes that leverage `logs-elastic_agent.status_change`
## References
- Internal KB article: https://support.elastic.co/knowledge/58b4ff69
- https://github.com/elastic/kibana/issues/235829
- https://github.com/elastic/kibana/issues/221633
## Suggested location
- `logs-elastic_agent.status_change` → [Monitor Elastic Agents](https://elastic.co/docs/reference/fleet/monitor-elastic-agent), in the "Enable alerts and ML jobs based on Fleet and Elastic Agent status" section, or a new section alongside the existing internal data streams table.
- Alerting rule templates → new page or section under Fleet/Elastic Agent reference, possibly linked from the Monitor Elastic Agents page.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.