elastic / elastic/integrations

[elastic_agent] Have agent status rule templates use alerting_v2 recovery query

Open
#18,886 2 comments 0 reactions 0 assignees View on GitHub
Team:Fleet
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

## Summary

Replace the large time-window workaround introduced in https://github.com/elastic/integrations/issues/18885 on agent status alerting rule templates with a proper recovery query, once `alerting_v2` exposes one for ES|QL rules.

Implementing PR for recovery queries: https://github.com/elastic/kibana/pull/255876

This issue will depend on the release of alerting_v2.

## Problem

The agent status rule templates are forced to use large time window queries since alerts auto-recover when the trigger query returns zero hits and the `elastic-agent.status_change` captures only status transitions. A stuck-unhealthy agent emits no further docs, so any finite window eventually false-recovers.

`alerting_v2` introduces separate an optional recovery policy query which allows us to define "alert when X happens, recover when Y happens" pattern needed here.

## Acceptance criteria
- Alerts open timely when an agent goes into an unhealthy status, and recovers when it transitions back to an unhealthy one.
- Each agent should receive its own alert
- All four status rule templates use alert and recovery conditions
- The wide-window mitigation from https://github.com/elastic/integrations/issues/18885 is reverted

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.