- Fleet and Elastic Agent Guide: other versions:
- Fleet and Elastic Agent overview
- Beats and Elastic Agent capabilities
- Quick starts
- Migrate from Beats to Elastic Agent
- Deployment models
- Install Elastic Agents
- Install Fleet-managed Elastic Agents
- Install standalone Elastic Agents
- Install Elastic Agents in a containerized environment
- Run Elastic Agent in a container
- Run Elastic Agent on Kubernetes managed by Fleet
- Install Elastic Agent on Kubernetes using Helm
- Example: Install standalone Elastic Agent on Kubernetes using Helm
- Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm
- Advanced Elastic Agent configuration managed by Fleet
- Configuring Kubernetes metadata enrichment on Elastic Agent
- Run Elastic Agent on GKE managed by Fleet
- Run Elastic Agent on Amazon EKS managed by Fleet
- Run Elastic Agent on Azure AKS managed by Fleet
- Run Elastic Agent Standalone on Kubernetes
- Scaling Elastic Agent on Kubernetes
- Using a custom ingest pipeline with the Kubernetes Integration
- Environment variables
- Run Elastic Agent as an OTel Collector
- Run Elastic Agent without administrative privileges
- Install Elastic Agent from an MSI package
- Installation layout
- Air-gapped environments
- Using a proxy server with Elastic Agent and Fleet
- Uninstall Elastic Agents from edge hosts
- Start and stop Elastic Agents on edge hosts
- Elastic Agent configuration encryption
- Secure connections
- Manage Elastic Agents in Fleet
- Configure standalone Elastic Agents
- Create a standalone Elastic Agent policy
- Structure of a config file
- Inputs
- Providers
- Outputs
- SSL/TLS
- Logging
- Feature flags
- Agent download
- Config file examples
- Grant standalone Elastic Agents access to Elasticsearch
- Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
- Example: Use standalone Elastic Agent with Elasticsearch Service to monitor nginx
- Debug standalone Elastic Agents
- Kubernetes autodiscovery with Elastic Agent
- Monitoring
- Reference YAML
- Manage integrations
- Package signatures
- Add an integration to an Elastic Agent policy
- View integration policies
- Edit or delete an integration policy
- Install and uninstall integration assets
- View integration assets
- Set integration-level outputs
- Upgrade an integration
- Managed integrations content
- Best practices for integrations assets
- Data streams
- Define processors
- Processor syntax
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Command reference
- Troubleshoot
- Release notes
Remote Elasticsearch output
editRemote Elasticsearch output
editBeginning in version 8.12.0, you can send Elastic Agent data to a remote Elasticsearch cluster. This is especially useful for data that you want to keep separate and independent from the deployment where you use Fleet to manage the agents.
A remote Elasticsearch cluster supports the same output settings as your main Elasticsearch cluster.
Using a remote Elasticsearch output with a target cluster that has traffic filters enabled is not currently supported.
To configure a remote Elasticsearch cluster for your Elastic Agent data:
- In Fleet, open the Settings tab.
- In the Outputs section, select Add output.
- In the Add new output flyout, provide a name for the output and select Remote Elasticsearch as the output type.
-
In the Hosts field, add the URL that agents should use to access the remote Elasticsearch cluster.
- To find the remote host address, in the remote cluster open Kibana and go to Management → Fleet → Settings.
- Copy the Hosts value for the default output.
- Back in your main cluster, paste the value you copied into the output Hosts field.
-
Create a service token to access the remote cluster.
- Below the Service Token field, copy the API request.
- In the remote cluster, open the Kibana menu and go to Management → Dev Tools.
- Run the API request.
- Copy the value for the generated token.
-
Back in your main cluster, paste the value you copied into the output Service Token field.
To prevent unauthorized access the Elasticsearch Service Token is stored as a secret value. While secret storage is recommended, you can choose to override this setting and store the password as plain text in the agent policy definition. Secret storage requires Fleet Server version 8.12 or higher. This setting can also be stored as a secret value or as plain text for preconfigured outputs. See Preconfiguration settings in the Kibana Guide to learn more.
- Choose whether or not the remote output should be the default for agent integrations or for agent monitoring data. When set, Elastic Agents use this output to send data if no other output is set in the agent policy.
-
Select which performance tuning settings you’d prefer in order to optimize Elastic Agent for throughput, scale, or latency, or leave the default
balanced
setting. - Add any advanced YAML configuration settings that you’d like for the output.
- Click Save and apply settings.
After the output is created, you can update an Elastic Agent policy to use the new remote Elasticsearch cluster:
- In Fleet, open the Agent policies tab.
- Click the agent policy to edit it, then click Settings.
- To send integrations data, set the Output for integrations option to use the output that you configured in the previous steps.
- To send Elastic Agent monitoring data, set the Output for agent monitoring option to use the output that you configured in the previous steps.
- Click Save changes.
The remote Elasticsearch cluster is now configured.
As a final step before using the remote Elasticsearch output, you need to make sure that for any integrations that have been added to your Elastic Agent policy, the integration assets have been installed on the remote Elasticsearch cluster. Refer to Install and uninstall Elastic Agent integration assets for the steps.