AI Agent Workflow Collection

After any stack upgrade or Fleet package install, re-check that built-in ILM policies have not silently reverted to the hot-only shipped definition.

Require every factual claim in an analysis to be traceable to a specific tool output -- name the tool and datasource, include the concrete supporting data point, and mark inferences explicitly as hypotheses rather than findings. Applies to the orchestrator and every sub-agent on every turn that states a finding.

Detect and remove data streams whose application stopped writing, where ILM keeps rolling empty write indices forever.

Add or replace a WHOLE Kibana dashboard NDJSON saved-object export in IaC -- commit a user-pasted/Kibana-exported NDJSON verbatim to environments/ /dashboards/ .ndjson + open an MR. MEDIUM risk -- dashboards are display-only; a malformed NDJSON fails CI's saved-objects import job, not production. WHOLE-FILE only: never edits panels/visualizations inside an existing saved object, never JSON.parses the file as one object (it is line-delimited). delete is not supported yet.

Step-by-step recovery for cold-tier OOM caused by an ILM frozen minage pull-in triggering force-merge stampede. Source incident eu-b2b 2026-05-15.

Create a GitLab merge request from an agent branch into main. Adds standard labels, milestone, and description template.

Pin a Fleet integration PACKAGE version in IaC (read-modify-write integrations.json + open an MR). NOT a Fleet agent binary upgrade, NOT a cluster version change. Validates the alias exists and flags major bumps.

Two-step pattern for cold-tier (or other autoscaling-ceiling) raises forced by an incident — raise tactically, then schedule the downsize once tuning/retention work has aged through. Prevents the incident raise becoming a permanent cost.

Quarterly (or pressure-driven) ILM retention audit — scope the heaviest policies, gather requirement vs query pattern, propose reductions through the change register.

Consolidate per-namespace Fleet data streams into one stream per subtype using a reroute processor wired via @custom hooks.

Re-query Elastic Cloud and the cluster API for the live state of a deployment before any change. Returns a state snapshot the maker step uses, plus an explicit pass/fail against the IR-174 five-condition pre-change gate.

Raise warm-phase replicas from 0 to 1 on core ILM policies to remove single-copy exposure for streams that must survive a node loss.