Platform health
A checkup of the Elastic cluster that carries your logs, with a verdict per check. The paid AI read groups failing checks by root cause and orders the fixes.
Platform health checks the Elastic cluster that carries your logs. Opening the page runs a checkup. The checkup and the AI read both need a Professional or Enterprise license, including a trial. Select Run again to repeat it.
Checkup results
Checkup overview gives a one-line verdict and three counts: Passing, To do (Failing and Watch), and Unavailable. The checks below are grouped the same way, each with its verdict, observed value, and reasoning.
Unavailable is not a fault. When the gateway account lacks an index privilege, or an API is unavailable, only the affected check is Unavailable and the others still run. Grant the privilege and run the checkup again. The cluster privilege monitor is the exception: without it the gateway cannot reach Elasticsearch and no check can be judged; see Elasticsearch account permissions.
Checks
| Check | Verdict |
|---|---|
| Cluster health | green is OK, red is Failing. yellow is Watch on a single data node, where unassigned replicas are expected, and Failing with several data nodes |
| Unassigned shards | When cluster health is Failing, lists the unassigned shards and the reason from allocation explain |
| Thread pool rejections | Watch if any node has rejections. The count accumulates from node start, so check your monitoring to see whether it is still rising |
| Disk watermark and read-only blocks | Failing if any index has a read_only_allow_delete block. Watch when a node's disk use reaches RST_OPS_DISK_WARN_PCT (default 90%) |
| ILM errors | Watch if any index is stuck in an ILM ERROR step |
| Ingest freshness | A whitelisted data stream with no new data for RST_OPS_STALE_WARN_H (default 6 hours) is Watch, and for RST_OPS_STALE_FAIL_H (default 24 hours) is Failing |
| Time baseline | Newest data ahead of the current time by RST_OPS_AHEAD_WARN_MIN (default 5 minutes) is Watch, and by RST_OPS_AHEAD_FAIL_MIN (default 30 minutes) is Failing. Hosts with clock skew and ingest lag are listed as well. The time-window hint in Ask AI uses the same data |
AI read
The check-up and the AI read are a paid capability (platform-ops copilot), available in Professional (14-day trial included) and above.
When some checks do not pass, the page shows AI read. The model analyzes those checks together: which share a root cause, what to fix first, and how. It consults the cluster runbooks in Runbooks and states how many passages it used. If the model returns nothing usable, the page orders the checks by their own severity.
The Platform issues card on Security posture shows the number of checks that do not pass. The top tabs of Platform health also hold Audit log and Outbound channels.
Reports
Daily, weekly, and monthly reports covering alert posture, top rules and entities, baseline pass rate, model usage, and health. On demand or scheduled, archived, and pushed.
Settings
Administrator configuration for the Elasticsearch connection, index allowlist, field masking, audit and forwarding, and online update. Changes apply immediately.