Configure Elastic Heartbeat for uptime synthetics monitoring (HTTP and ICMP checks)

Steps

1. Install Elastic Heartbeat on a host or container with access to the targets to monitor; configure heartbeat.yml with the output section pointing to an Elasticsearch cluster or Elastic Cloud endpoint with credentials.
2. Define monitors in the heartbeat.monitors section; for HTTP checks set type: http, urls as a list of targets, schedule as a cron expression or @every interval, and check.response with expected status codes and optional body content assertions.
3. For ICMP ping checks set type: icmp and hosts as the list of IP addresses or hostnames; Heartbeat requires elevated privileges (or a Linux capability grant) to send raw ICMP packets — confirm the process has the necessary permissions.
4. Enable TLS certificate expiry monitoring by setting check.response.status to 200 and ssl.certificate_authorities if using private CAs; Heartbeat also reports the days-until-expiry of the TLS certificate on each check, which can drive certificate expiry alerts.
5. Configure alerting in Kibana Observability > Alerts; use the built-in Uptime monitor status rule to alert when a monitor is down for a configurable consecutive-check count, and the TLS certificate expiry rule to alert before certificates expire.
6. View results in Kibana Observability > Uptime (or Synthetics in newer Elastic Stack versions); the overview shows a status timeline per monitor, geographic availability heatmap when multiple agents are configured, and duration trends over time.