Configure APM instrumentation

Libbeat uses the Elastic APM Go Agent to instrument its publishing pipeline. Currently, only the Elasticsearch output is instrumented. To gain insight into the performance of Auditbeat, you can enable this instrumentation and send trace data to the APM Integration.

Example configuration with instrumentation enabled:

instrumentation:
  enabled: true
  environment: production
  hosts:
    - "http://localhost:8200"
  api_key: L5ER6FEvjkmlfalBealQ3f3fLqf03fazfOV

Configuration options

edit

You can specify the following options in the instrumentation section of the auditbeat.yml config file:

`enabled`

edit

Set to true to enable instrumentation of Auditbeat. Defaults to false.

`environment`

edit

Set the environment in which Auditbeat is running, for example, staging, production, dev, etc. Environments can be filtered in the APM app.

`hosts`

edit

The APM integration host to report instrumentation data to. Defaults to http://localhost:8200.

`api_key`

edit

The API Key used to secure communication with the APM Integration. If api_key is set then secret_token will be ignored.

`secret_token`

edit

The Secret token used to secure communication with the APM Integration.

`profiling.cpu.enabled`

edit

Set to true to enable CPU profiling, where profile samples are recorded as events.

This feature is experimental.

`profiling.cpu.interval`

edit

Configure the CPU profiling interval. Defaults to 60s.

This feature is experimental.

`profiling.cpu.duration`

edit

Configure the CPU profiling duration. Defaults to 10s.

This feature is experimental.

`profiling.heap.enabled`

edit

Set to true to enable heap profiling.

This feature is experimental.

`profiling.heap.interval`

edit

Configure the heap profiling interval. Defaults to 60s.

This feature is experimental.

« Regular expression support Configure feature flags »