Adding modules to Fleet agent

Hi, I have Elastic Cloud 7.14.0, using Fleet and an Agent on a Centos 7 server. Works great.

I want to enable modules that aren't necessarily a click-and-configure in the Fleet UI. Can i modify some file locally on the server to add Filebeat modules or my own custom modules to the Elastic Agent?

For example, I want to add the Threat Intel module to the Elastic Agent.


In the same boat, would like to see Threat Intel enabled by default to be honest.

Core beats aren't configurable from what I can see, not easily or well documented anyway

Hi, unfortunately at the moment this is not possible yet. We are working and bringing the existing modules to integrations in Fleet. Maybe open an issue around this in GitHub - elastic/integrations: Elastic Integrations as a feature request?

Thanks @Brendan_Jennings & @ruflin .

In the meantime whats the best approach to do this? Would it be to install Filebeat separately (in addition to Elastic Agent) and configure other modules in Filebeat as needed?

Yes, I would just install Filebeat separately for now. The issue to copy the threat Intel modules is here, Migrate Threat Intel package · Issue #650 · elastic/integrations · GitHub

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.