[Fleet] Add "last data received" field to agent details #121885
Labels
enhancement
New value added to drive a business result
Team:Fleet
Team label for Observability Data Collection Fleet team
Today we currently show a timestamp labeled "Last activity" which indicates the last time an Agent checked in with the Fleet Server.
This timestamp can give a false sense of security that the agent is properly ingesting data and could hide network or configuration issues with the connection between the Agent and Elasticsearch. It would be helpful for troubleshooting if we also indicated the last time data was sent by the Agent to Elasticsearch.
This could be a simple query on all the
metrics-*,logs-*,traces-*,synthetics-*
data streams for the latest document for the given agent id. We should be careful about the performance of this query since it could hit many shards. Theallow_partial_search_results
andtimeout
search options may be helpful here.The text was updated successfully, but these errors were encountered: