Configure logging for standalone Elastic Agents

Setting

Description

agent.logging.level

The minimum log level.

Possible values:

Default: info

agent.logging.selectors

Specify the selector tags that are used by different Elastic Agent components for debugging. To debug the output for all components, use *. To display debug messages related to event publishing, set to publish. Multiple selectors can be chained.

Possible values: [beat], [publish], [service]

agent.logging.to_stderr

Set to true to write all logging output to the stderr output—this is equivalent to using the -e command line option.

Default: true

agent.logging.to_syslog

Set to true to write all logging output to the syslog output.

Default: false

agent.logging.to_eventlog

Set to true to write all logging output to the Windows eventlog output.

Default: false

agent.logging.metrics.enabled

Set to true for Elastic Agent to periodically log its internal metrics that have changed in the last period. For each metric that changed, the delta from the value at the beginning of the period is logged. Also, the total values for all non-zero internal metrics get logged on shutdown.

Default: true

agent.logging.metrics.period

Specify the period after which to log the internal metrics.

Default: 30s

agent.logging.to_files

Set to true to log to rotating files. Set to false to disable logging to files.

Default: true

agent.logging.files.path

The directory that log files is written to.

Logs are numbered log.1, log.2, and so on as they are rotated off the main log.

agent.logging.files.name

The name of the file that logs are written to.

Default: elastic-agent

agent.logging.files.rotateeverybytes

The maximum size limit of a log file. If the limit is reached, a new log file is generated.

Default: 10485760 (10MB)

agent.logging.files.keepfiles

The most recent number of rotated log files to keep on disk. Older files are deleted during log rotation. The value must be in the range of 2 to 1024 files.

Default: 7

agent.logging.files.permissions

The permissions mask to apply when rotating log files. The permissions option must be a valid Unix-style file permissions mask expressed in octal notation. In Go, numbers in octal notation must start with 0.

Default: 0600

agent.logging.files.interval

Enable log file rotation on time intervals in addition to the size-based rotation. Intervals must be at least 1s. Values of 1m, 1h, 24h, 7*24h, 30*24h, and 365*24h are boundary-aligned with minutes, hours, days, weeks, months, and years as reported by the local system clock. All other intervals get calculated from the Unix epoch.

Default: 0 (disabled)

agent.logging.files.rotateonstartup

Set to true to rotate existing logs on startup rather than to append to the existing file.

Default: true

agent.logging.json

Set to true to log messages in JSON format.

Default: false

agent.logging.ecs

Set to true to log messages with the minimal required Elastic Common Schema (ECS) information. We recommended using this option in combination with agent.logging.json: true.

Default: false