Configure standalone Elastic Agents

edit

Configure standalone Elastic Agents

edit

Running Elastic Agent in standalone mode is an advanced use case. The documentation is incomplete and not yet mature. When possible, we recommend using Fleet-managed agents instead of standalone mode.

To get started quickly, use Kibana to create and download a standalone policy file. You’ll still need to deploy and manage the file, though. For more information, refer to Create a standalone Elastic Agent policy.

Standalone Elastic Agents are manually configured and managed locally on the systems where they are installed. They are useful when you are not interested in centrally managing agents in Fleet, either due to your company’s security requirements, or because you prefer to use another configuration management system.

To configure standalone Elastic Agents, specify settings in the elastic-agent.yml policy file deployed with the agent. Prior to installation, the file is located in the extracted Elastic Agent package. After installation, the file is copied to the directory described in Installation layout. To apply changes after installation, you must modify the installed file.

For installation details, refer to Install standalone Elastic Agents (advanced users).

Alternatively, you can put input configurations in YAML files into the folder {path.config}/inputs.d to separate your configuration into multiple smaller files. The YAML files in the inputs.d folder should contain input configurations only. Any other configurations are ignored. The files are reloaded at the same time as the standalone configuration.

The first line of the configuration must be inputs. Then you can list the inputs you would like to run. Each input in the policy must have a unique value for the id key. If the id key is missing its value defaults to the empty string "".

inputs:
  - id: unique-logfile-id
    type: logfile
    data_stream.namespace: default
    paths: [/path/to/file]
    use_output: default

  - id: unique-system-metrics-id
    type: system/metrics
    data_stream.namespace: default
    use_output: default
    streams:
      - metricset: cpu
        data_stream.dataset: system.cpu

The following sections describe some settings you might need to configure to run an Elastic Agent standalone. For a full reference example, refer to the elastic-agent.reference.yml file.

The settings described here are available for standalone Elastic Agents. Settings for Fleet-managed agents are specified through the UI. You do not set them explicitly in a policy file.