elastic / elastic/integrations
[elastic_agent] 'High pipeline queue' rule can be sensitive to transient queue spikes
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
## Summary
The `[Elastic Agent] High pipeline queue` alerting rule fires on a single 30s monitoring sample reaching >= 90% queue saturation within a 1-minute window. This can produce noisy alerts for brief, self-recovering spikes that may not correlate with data loss or sustained output backpressure.
Rule: [elastic-agent-high-pipeline-queue.json](https://github.com/elastic/integrations/blob/main/packages/elastic_agent/kibana/alerting_rule_template/elastic-agent-high-pipeline-queue.json)
## Suggestions
Update the default ES|QL / rule params so the alert only fires on sustained saturation. Options (combinable):
- Extend `timeWindowSize` to 3–5m and switch the aggregation from MAX to PERCENTILE(..., 90) or AVG.
- Set `alertDelay.active: 3` so the condition must hold across multiple evaluation intervals.
## Acceptance criteria
- Default rule does not fire on isolated 30s saturation samples that recover on the next sample.
- Rule still fires within ~5 minutes when queue saturation is sustained.
- No change in shape of the alert payload (same grouping by elastic_agent.id + component.id).
Contributor guide
Assessment
This issue has not been assessed yet.