elastic / elastic/docs-content

Document logs-elastic_agent.status_change data stream and out-of-the-box alert templates (9.3+)

Open
#8,003 1 comment 0 reactions 1 assignee Claimed by @mdbirnstiehl View on GitHub
Team:SKI
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 12h
Merged PRs (30d)
116

Description

## Summary

Starting in 9.3.0, Fleet and Elastic Agents produce a new data stream — `logs-elastic_agent.status_change` — that is currently undocumented. At the same time, 9.3.0 introduces the concept of **alerting rule templates** installed as integration assets, which use this data stream. Neither feature is documented in the public docs.

## What's missing

### 1. `logs-elastic_agent.status_change` data stream

The data stream records agent status change events (healthy → unhealthy, upgrades, unenrolled, etc.). It is produced by Fleet & Elastic Agents starting in 9.3.0 and can be used to build custom alerts.

Currently, the [Monitor Elastic Agents](https://elastic.co/docs/reference/fleet/monitor-elastic-agent) and [Elastic Agent data streams for Fleet](https://elastic.co/docs/reference/fleet/data-streams) pages only document two internal Fleet data streams for agent status monitoring:
- `metrics-fleet_server.agent_status-default`
- `metrics-fleet_server.agent_versions-default`

`logs-elastic_agent.status_change` should be documented alongside these (or in a dedicated section), including:
- What events it captures (status changes: healthy/unhealthy/upgrading/unenrolled/…)
- Available fields
- How to use it to build custom alerts

### 2. Kibana Alert Templates installed as integration assets (9.3.0+)

Starting in 9.3.0, Elastic Agent integrations can ship with **alerting rule templates** installed alongside other integration assets (index templates, ingest pipelines, etc.). Templates can be accessed from **Kibana › Stack Management › Rules › Create Rule**, then selecting a Template.

This is a new concept — alerting templates as first-class integration assets — that has no public documentation.

Documentation should cover:
- What alerting rule templates are and how they differ from regular rules
- How to browse and use templates from the Create Rule UI
- Which integrations ship with templates (or note that not all do)
- The out-of-the-box alert templates for Elastic Agent status changes that leverage `logs-elastic_agent.status_change`

## References

- Internal KB article: https://support.elastic.co/knowledge/58b4ff69
- https://github.com/elastic/kibana/issues/235829
- https://github.com/elastic/kibana/issues/221633

## Suggested location

- `logs-elastic_agent.status_change` → [Monitor Elastic Agents](https://elastic.co/docs/reference/fleet/monitor-elastic-agent), in the "Enable alerts and ML jobs based on Fleet and Elastic Agent status" section, or a new section alongside the existing internal data streams table.
- Alerting rule templates → new page or section under Fleet/Elastic Agent reference, possibly linked from the Monitor Elastic Agents page.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.