« AI Assistant Technical preview limitations »
Elastic Docs ›Serverless ›Elastic Observability serverless

Elastic Entity Model

edit

Elastic Entity Model

edit

[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

The Elastic Entity Model consists of:

  • a data model and related entity indices
  • an Entity Discovery Framework, which consists of transforms and Ingest pipelines that read from signal indices and write data to entity indices
  • a set of management APIs that empower entity-centric Elastic solution features and workflows

In Elastic Observability, an entity is an object of interest that can be associated with produced telemetry and identified as unique. Note that this definition is intentionally closely aligned to the work of the OpenTelemetry Entities SIG. Examples of entities include (but are not limited to) services, hosts, and containers.

The concept of an entity is important as a means to unify observability signals based on the underlying entity that the signals describe.

Notes

  • The Elastic Entity Model currently supports the new inventory experience limited to service, host, and container entities.
  • During Technical Preview, Entity Discovery Framework components are not enabled by default.

Enable the Elastic Entity Model

edit

Required role

The Admin role or higher is required to enable the Elastic Entity Model. To learn more, refer to Assign user roles and privileges.

You can enable the Elastic Entity Model from the new Inventory. If already enabled, you will not be prompted to enable the Elastic Entity Model.

Disable the Elastic Entity Model

edit

Required role

The Admin role or higher is required to enable the Elastic Entity Model. To learn more, refer to Assign user roles and privileges.

From the Dev Console, run the command: DELETE kbn:/internal/entities/managed/enablement

Limitations

edit
  • Cross-cluster search (CCS) is not supported. EEM cannot leverage data stored on a remote cluster.
  • Services are only detected from documents where service.name is detected in index patterns that match either logs-* or apm-*.
« AI Assistant Technical preview limitations »