elastic / elastic/integrations

[elastic_agent] 'High pipeline queue' rule can be sensitive to transient queue spikes

Open
#18,884 2 comments 0 reactions 0 assignees View on GitHub
Team:Fleet
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

## Summary
The `[Elastic Agent] High pipeline queue` alerting rule fires on a single 30s monitoring sample reaching >= 90% queue saturation within a 1-minute window. This can produce noisy alerts for brief, self-recovering spikes that may not correlate with data loss or sustained output backpressure.

Rule: [elastic-agent-high-pipeline-queue.json](https://github.com/elastic/integrations/blob/main/packages/elastic_agent/kibana/alerting_rule_template/elastic-agent-high-pipeline-queue.json)

## Suggestions

Update the default ES|QL / rule params so the alert only fires on sustained saturation. Options (combinable):

- Extend `timeWindowSize` to 3–5m and switch the aggregation from MAX to PERCENTILE(..., 90) or AVG.
- Set `alertDelay.active: 3` so the condition must hold across multiple evaluation intervals.

## Acceptance criteria
- Default rule does not fire on isolated 30s saturation samples that recover on the next sample.
- Rule still fires within ~5 minutes when queue saturation is sustained.
- No change in shape of the alert payload (same grouping by elastic_agent.id + component.id).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.