# Agent log level sending info & debug, how to change level

**URL:** https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370
**Category:** Elasticsearch
**Tags:** fleet
**Created:** [October 24, 2024, 2:24pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370 "2024-10-24T14:24:00Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [October 24, 2024, 2:24pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/1 "2024-10-24T14:24:00Z")

</div>

I found that my busiest index was a logs-elastic\_agent.filebeat-default index, so I looked into what was being sent. I found a simple custom logs (filebeat) agent that was sending at debug level. Over 8 million events to the cloud that I don't really need...

I found "Collect agent logs" in settings, but no way to change the log level?

Is there a way to change it? Why did it get set to debug on a single system?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 24, 2024, 2:31pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/2 "2024-10-24T14:31:12Z")

</div>

Are your agents Fleet Managed or Standalone Agents?

Which version are you using?

If I'm not wrong the default log level is `info`, for it to be running with `debug` someone may have changed it manually.

---

<div class="post-metadata">

### Author: ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [October 24, 2024, 3:20pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/3 "2024-10-24T15:20:18Z")

</div>

Fleet managed, Elastic cloud, 8.15.3.

It could be info, maybe not debug, I was using the log viewer in Fleet and selecting the level filters, I had never used it before

IMHO, info is too chatty to send to the cloud. I found a second host, so over 24 hours, I ingested 16 million lines of basically "end of file reached".

If info is the default, is there a way in Fleet to change it?

Thanks

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 24, 2024, 4:10pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/4 "2024-10-24T16:10:00Z")

</div>

In 8.15 you can change it direct in the policy settings:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2639727f6e11ecdfbf9901d2f6a51c91304e31ea.png)

This is a policy setting, but I think that setting it in individual agents will override the configuration from the policy.

You can change it per agent going into the agents page \> logs

![image](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f47f6611b201db1c07a2e86c4ff07527e2ab29ea.png)

---

<div class="post-metadata">

### Author: ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [October 24, 2024, 4:32pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/5 "2024-10-24T16:32:18Z")

</div>

I don't see that line on the agents page. I go to All Agents, click on the desired host, then should be at what you are calling the agents page?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 24, 2024, 4:58pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/6 "2024-10-24T16:58:49Z")

</div>

> [@rugenl](#):
>
> I go to All Agents, click on the desired host, then should be at what you are calling the agents page?

Click on the desired host and then on the Logs tab, there are three tabs _Agent details_, _Logs_ and _Diagnostics_.

---

<div class="post-metadata">

### Author: ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [October 24, 2024, 5:02pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/7 "2024-10-24T17:02:40Z")

</div>

In mine, that just filters the view of the logs

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1e3843465e5298dbca89b7a67d74a9e180e41d02.png)

But fleet filtering local\_metadata.elastic.agent.log\_level : debug  
shows my two problem hosts.

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 24, 2024, 5:29pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/8 "2024-10-24T17:29:05Z")

</div>

> [@rugenl](#):
>
> In mine, that just filters the view of the logs

It is in the end of that page on the left side.

I do not collect agent logs, but this is how it shows up on mine.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99e71872eef53e9316ff0ea59a62ffd4c3e2962d.png)

Is you can see, there is the option in the left botton corner.

---

<div class="post-metadata">

### Author: ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [October 24, 2024, 5:48pm UTC](https://discuss.elastic.co/t/agent-log-level-sending-info-debug-how-to-change-level/369370/9 "2024-10-24T17:48:22Z")

</div>

Good grief, that is the most non-intuitive location for an updateable field that I've ever seen, below scrollable logs....
