Agent log level sending info & debug, how to change level

Elastic Stack Elasticsearch
1

I found that my busiest index was a logs-elastic_agent.filebeat-default index, so I looked into what was being sent. I found a simple custom logs (filebeat) agent that was sending at debug level. Over 8 million events to the cloud that I don't really need...

I found "Collect agent logs" in settings, but no way to change the log level?

Is there a way to change it? Why did it get set to debug on a single system?

2

Are your agents Fleet Managed or Standalone Agents?

Which version are you using?

If I'm not wrong the default log level is info, for it to be running with debug someone may have changed it manually.

1 Like
3

Fleet managed, Elastic cloud, 8.15.3.

It could be info, maybe not debug, I was using the log viewer in Fleet and selecting the level filters, I had never used it before

IMHO, info is too chatty to send to the cloud. I found a second host, so over 24 hours, I ingested 16 million lines of basically "end of file reached".

If info is the default, is there a way in Fleet to change it?

Thanks

4

In 8.15 you can change it direct in the policy settings:

image
image1248×117 9.01 KB

This is a policy setting, but I think that setting it in individual agents will override the configuration from the policy.

You can change it per agent going into the agents page > logs

image

5

I don't see that line on the agents page. I go to All Agents, click on the desired host, then should be at what you are calling the agents page?

6

Click on the desired host and then on the Logs tab, there are three tabs Agent details, Logs and Diagnostics.

7

In mine, that just filters the view of the logs

image
image1374×355 50.3 KB

But fleet filtering local_metadata.elastic.agent.log_level : debug
shows my two problem hosts.

8

It is in the end of that page on the left side.

I do not collect agent logs, but this is how it shows up on mine.

image
image1574×894 34.2 KB

Is you can see, there is the option in the left botton corner.

9

Good grief, that is the most non-intuitive location for an updateable field that I've ever seen, below scrollable logs....