Can We Temporarily Disable Filestream Integration for a Elastic Agent Policy to temporarily collect data instead of unenroll it?

[josh_tran (Phuc Tran)]

Hi all,

Currently, my system is collecting log data using Filestream (Custom Logs integration). The thousand agents are managed by policies in the Fleet server.

The machines that have the Agents installed usually need to be checked and maintained, and we want to stop collecting data temporarily to investigate.

Is there any option to disable Filebeat on the Agents temporarily, without unenrolling them from Fleet or uninstalling policies (there are many setup steps we do not want to reconfigure)?

I find there is a toggle in the Integration Settings, but I’m not sure if this disables the collection. I tested it, and when I disable the toggle, some data still gets sent to Logstash from the Agents.

[Tortoise]

Hello @josh_tran

Yes , ideally if we disable the integration it should stop sending data related to the integration which is disabled.

In your case is it sending the data related to filestream (logpath configured to read custom logs) or they are the agent logs/metrics which are sent ?

Thanks!!