- Fleet and Elastic Agent Guide: other versions:
- Fleet and Elastic Agent overview
- Beats and Elastic Agent capabilities
- Quick starts
- Migrate from Beats to Elastic Agent
- Deployment models
- Install Elastic Agents
- Install Fleet-managed Elastic Agents
- Install standalone Elastic Agents
- Install Elastic Agents in a containerized environment
- Run Elastic Agent in a container
- Run Elastic Agent on Kubernetes managed by Fleet
- Install Elastic Agent on Kubernetes using Helm
- Example: Install standalone Elastic Agent on Kubernetes using Helm
- Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm
- Advanced Elastic Agent configuration managed by Fleet
- Configuring Kubernetes metadata enrichment on Elastic Agent
- Run Elastic Agent on GKE managed by Fleet
- Run Elastic Agent on Amazon EKS managed by Fleet
- Run Elastic Agent on Azure AKS managed by Fleet
- Run Elastic Agent Standalone on Kubernetes
- Scaling Elastic Agent on Kubernetes
- Using a custom ingest pipeline with the Kubernetes Integration
- Environment variables
- Run Elastic Agent as an OTel Collector
- Run Elastic Agent without administrative privileges
- Install Elastic Agent from an MSI package
- Installation layout
- Air-gapped environments
- Using a proxy server with Elastic Agent and Fleet
- Uninstall Elastic Agents from edge hosts
- Start and stop Elastic Agents on edge hosts
- Elastic Agent configuration encryption
- Secure connections
- Manage Elastic Agents in Fleet
- Configure standalone Elastic Agents
- Create a standalone Elastic Agent policy
- Structure of a config file
- Inputs
- Providers
- Outputs
- SSL/TLS
- Logging
- Feature flags
- Agent download
- Config file examples
- Grant standalone Elastic Agents access to Elasticsearch
- Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
- Example: Use standalone Elastic Agent with Elasticsearch Service to monitor nginx
- Debug standalone Elastic Agents
- Kubernetes autodiscovery with Elastic Agent
- Monitoring
- Reference YAML
- Manage integrations
- Package signatures
- Add an integration to an Elastic Agent policy
- View integration policies
- Edit or delete an integration policy
- Install and uninstall integration assets
- View integration assets
- Set integration-level outputs
- Upgrade an integration
- Managed integrations content
- Best practices for integrations assets
- Data streams
- Define processors
- Processor syntax
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Command reference
- Troubleshoot
- Release notes
Elastic Agent health status
editElastic Agent health status
editThe Elastic Agent monitoring documentation describes the features available through the Fleet UI for you to view Elastic Agent status and activity, access metrics and diagnostics, enable alerts, and more.
For details about how the Elastic Agent status is monitored by Fleet, including connectivity, check-in frequency, and similar, see the following:
- How does Elastic Agent connect to the Fleet to report its availability and health, and receive policy updates?
- We use stack monitoring to monitor the status of our cluster. Is monitoring of Elastic Agent and the status shown in Fleet using stack monitoring as well?
- There are many components that make up Elastic Agent. How does Elastic Agent ensure that these components/processes are up and running, and healthy?
- If Elastic Agent goes down, is an alert generated by Fleet?
- How long does it take for Elastic Agent to report a status change?
How does Elastic Agent connect to the Fleet to report its availability and health, and receive policy updates?
editAfter enrollment, Elastic Agent regularly initiates a check-in to Fleet Server using HTTP long-polling (Fleet Server is either deployed on-premises or deployed as part of Elasticsearch in Elastic Cloud).
The HTTP long-polling request is kept open until there’s a configuration change that Elastic Agent needs to consume, an action that is sent to the agent, or a 5 minute timeout has elapsed. After 5 minutes, the agent will again send another check-in to start the process over again.
The frequency of check-ins can be configured to a new value with the condition that it may affect the maximum number of agents that can connect to Fleet. Our regular scale testing of the solution doesn’t modify this parameter.

We use stack monitoring to monitor the status of our cluster. Is monitoring of Elastic Agent and the status shown in Fleet using stack monitoring as well?
editNo. The health monitoring of Elastic Agent and its inputs, as reported in Fleet, is done completely outside of what stack monitoring provides.
There are many components that make up Elastic Agent. How does Elastic Agent ensure that these components/processes are up and running, and healthy?
editElastic Agent is essentially a supervisor that (at a minimum) will deploy a Filebeat instance for log collection and a Metricbeat instance for metrics collection from the system and applications running on that system. As a supervisor, it also ensures that these spawned processes are running and healthy. Using gRPC, Elastic Agent communicates with the underlying processes once every 30 seconds, ensuring their health. If there’s no response, the agent will transfer to being Unhealthy
with the result and details reported to Fleet.
If Elastic Agent goes down, is an alert generated by Fleet?
editNo. Alerts would have to be created in Kibana on the indices that show the total count of agents at each specific state. Refer to Enable alerts and ML jobs based on Fleet and Elastic Agent status in the Elastic Agent monitoring documentation for the steps to configure alerting. Generating alerts on status change on individual agents is currently planned for a future release.
How long does it take for Elastic Agent to report a status change?
editSome Elastic Agent states are reported immediately, such as when the agent has become Unhealthy
. Some other states are derived after a certain criteria is met. Refer to View agent status overview in the Elastic Agent monitoring documentation for details about monitoring agent status.
Transition from an Offline
state to an Inactive
state is configurable by the user and that transition can be fine tuned by Setting the inactivity timeout parameter.
On this page
- How does Elastic Agent connect to the Fleet to report its availability and health, and receive policy updates?
- We use stack monitoring to monitor the status of our cluster. Is monitoring of Elastic Agent and the status shown in Fleet using stack monitoring as well?
- There are many components that make up Elastic Agent. How does Elastic Agent ensure that these components/processes are up and running, and healthy?
- If Elastic Agent goes down, is an alert generated by Fleet?
- How long does it take for Elastic Agent to report a status change?