IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Structure of a config file Simplified log ingestion »

› ›

Configure inputs for standalone Elastic Agents

edit

Configure inputs for standalone Elastic Agents

edit

The inputs section of the elastic-agent.yml file specifies how Elastic Agent locates and processes input data.

Sample metrics input configuration

edit

By default Elastic Agent collects system metrics, such as CPU, memory, network, and file system metrics, and sends them to the default output. For example, to define datastreams for cpu, memory, network and filesystem metrics, this is the configuration:

- type: system/metrics 
  id: unique-system-metrics-id 
  data_stream.namespace: default 
  use_output: default 
  streams:
    - metricsets: 
      - cpu
      data_stream.dataset: system.cpu 
    - metricsets:
      - memory
      data_stream.dataset: system.memory
    - metricsets:
      - network
      data_stream.dataset: system.network
    - metricsets:
      - filesystem
      data_stream.dataset: system.filesystem

	The name of the input. Refer to Elastic Agent inputs for the list of what’s available.
	A unique ID for the input.
	A user-defined namespace.
	The name of the `output` to use. If not specified, `default` will be used.
	The set of enabled module metricsets. Refer to the Metricbeat System module for a list of available options. The metricset fields can be configured.
	A user-defined dataset. It can contain anything that makes sense to signify the source of the data.

Sample log files input configuration

edit

To enable Elastic Agent to collect log files, you can use a configuration like the following.

- type: filestream 
  id: your-input-id 
  streams:
    - id: your-filestream-stream-id 
      data_stream: 
        dataset: generic
      paths:
        - /var/log/*.log

	The name of the input. Refer to Elastic Agent inputs for the list of what’s available.
	A unique ID for the input.
	A unique ID for the data stream to track the state of the ingested files.
	The streams block is required only if multiple streams are used on the same input. Refer to the Filebeat filestream documentation for a list of available options. Also, specifically for the `filestream` input type, refer to the simplified log ingestion for an example of ingesting a set of logs specified as an array.

The input in this example harvests all files in the path /var/log/*.log, that is, all logs in the directory /var/log/ that end with .log. All patterns supported by Go Glob are also supported here.

To fetch all files from a predefined level of subdirectories, use this pattern: /var/log/*/*.log. This fetches all .log files from the subfolders of /var/log. It does not fetch log files from the /var/log folder itself. Currently it is not possible to recursively fetch all files in all subdirectories of a directory.

« Structure of a config file Simplified log ingestion »