Adding modules to Fleet agent

Elastic Stack Beats
1

Hi, I have Elastic Cloud 7.14.0, using Fleet and an Agent on a Centos 7 server. Works great.

I want to enable modules that aren't necessarily a click-and-configure in the Fleet UI. Can i modify some file locally on the server to add Filebeat modules or my own custom modules to the Elastic Agent?

For example, I want to add the Threat Intel module to the Elastic Agent.

2 Likes
2

In the same boat, would like to see Threat Intel enabled by default to be honest.

Core beats aren't configurable from what I can see, not easily or well documented anyway

3

Hi, unfortunately at the moment this is not possible yet. We are working and bringing the existing modules to integrations in Fleet. Maybe open an issue around this in GitHub - elastic/integrations: Elastic Integrations as a feature request?

4

Thanks @Brendan_Jennings & @ruflin .

In the meantime whats the best approach to do this? Would it be to install Filebeat separately (in addition to Elastic Agent) and configure other modules in Filebeat as needed?

5

Yes, I would just install Filebeat separately for now. The issue to copy the threat Intel modules is here, Migrate Threat Intel package · Issue #650 · elastic/integrations · GitHub

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.