elastic / elastic/integrations
[elastic_agent] Have agent status rule templates use alerting_v2 recovery query
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
## Summary
Replace the large time-window workaround introduced in https://github.com/elastic/integrations/issues/18885 on agent status alerting rule templates with a proper recovery query, once `alerting_v2` exposes one for ES|QL rules.
Implementing PR for recovery queries: https://github.com/elastic/kibana/pull/255876
This issue will depend on the release of alerting_v2.
## Problem
The agent status rule templates are forced to use large time window queries since alerts auto-recover when the trigger query returns zero hits and the `elastic-agent.status_change` captures only status transitions. A stuck-unhealthy agent emits no further docs, so any finite window eventually false-recovers.
`alerting_v2` introduces separate an optional recovery policy query which allows us to define "alert when X happens, recover when Y happens" pattern needed here.
## Acceptance criteria
- Alerts open timely when an agent goes into an unhealthy status, and recovers when it transitions back to an unhealthy one.
- Each agent should receive its own alert
- All four status rule templates use alert and recovery conditions
- The wide-window mitigation from https://github.com/elastic/integrations/issues/18885 is reverted
Contributor guide
Assessment
This issue has not been assessed yet.