This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« View Elastic Agent integration assets Upgrade an Elastic Agent integration »
Elastic Docs ›Fleet and Elastic Agent Guide [master] ›Manage Elastic Agent integrations

Set integration-level outputs

edit

Set integration-level outputs

edit

If you have an Enterprise Elastic Stack subscription, you can configure Elastic Agent data to be sent to different outputs for different integration policies. Note that the output clusters that you send data to must also be on the same subscription level.

Integration-level outputs are very useful for certain scenarios. For example:

  • You can may want to send security logs monitored by an Elastic Agent to one Logstash output, while informational logs are sent to a another Logstash output.
  • If you operate multiple Beats on a system and want to migrate these to Elastic Agent, integration-level outputs enable you to maintain the distinct outputs that are currently used by each Beat.

Order of precedence

edit

For each Elastic Agent, the agent policy configures sending data to the following outputs in decreasing order of priority:

  1. The output set in the integration policy.
  2. The output set in the integration’s parent Elastic Agent policy. This includes the case where an integration policy belongs to multiple Elastic Agent policies.
  3. The global, default data output set in the Fleet settings.

Configure the output for an integration policy

edit

To configure an integration-level output for Elastic Agent data:

  1. In Kibana, go to Integrations.
  2. On the Installed integrations tab, select the integration that you’d like to update.
  3. Open the Integration policies tab.
  4. From the Actions menu next to the integration, select Edit integration.
  5. In the integration settings section, expand Advanced options.
  6. Use the Output dropdown menu to select an output specific to this integration policy.
  7. Click Save and continue to confirm your changes.

View the output configured for an integration

edit

To view which Elastic Agent output is set for an integration policy:

  1. In Fleet, open the Agent policies tab.
  2. Select an Elastic Agent policy.
  3. On the Integrations tab, the Output column indicates the output used for each integration policy. If data is configured to be sent to either the global output defined in Fleet settings or to the integration’s parent Elastic Agent policy, this is indicated in a tooltip.
« View Elastic Agent integration assets Upgrade an Elastic Agent integration »