Configure APM instrumentation

Libbeat uses the Elastic APM Go Agent to instrument its publishing pipeline. Currently, only the Elasticsearch output is instrumented. To gain insight into the performance of Auditbeat, you can enable this instrumentation and send trace data to the APM Integration.

Example configuration with instrumentation enabled:

instrumentation:
  enabled: true
  environment: production
  hosts:
    - "http://localhost:8200"
  api_key: L5ER6FEvjkmlfalBealQ3f3fLqf03fazfOV

You can specify the following options in the instrumentation section of the auditbeat.yml config file:

Set to true to enable instrumentation of Auditbeat. Defaults to false.

Set the environment in which Auditbeat is running, for example, staging, production, dev, etc. Environments can be filtered in the APM app.

The APM integration host to report instrumentation data to. Defaults to http://localhost:8200.

The API Key used to secure communication with the APM Integration. If api_key is set then secret_token will be ignored.

The Secret token used to secure communication with the APM Integration.

Set to true to enable CPU profiling, where profile samples are recorded as events.

This feature is experimental.

Configure the CPU profiling interval. Defaults to 60s.

This feature is experimental.

Configure the CPU profiling duration. Defaults to 10s.

This feature is experimental.

Set to true to enable heap profiling.

This feature is experimental.

Configure the heap profiling interval. Defaults to 60s.

This feature is experimental.