I'm using elastic-agent (dockerized) in manual mode. Earlier I used the same setup, just a dockerized filebeat instead of dockerized elastic-agent. To avoid shipping duplicate logs after container restart, we persistet the filebeat registry. I'm trying now to persist the filebeat registry for the dockerized elastic-agent using the following configuration (elastic-agent.yml):
management:
mode: "local"
filebeat:
registry:
path: /usr/share/elastic-agent/data/filebeat/registry
logging:
level: info
selectors: ["*"]
to_stderr: true
to_files: false
to_syslog: false
to_eventlog: false
metrics.enabled: true
metrics.period: 60s
agent:
retry:
enabled: true
monitoring:
enabled: true
use_output: default
logs: true
metrics: true
logging:
level: info
selectors: ["*"]
to_stderr: true
to_files: false
to_syslog: false
to_eventlog: false
metrics.enabled: true
metrics.period: 60s
json: false
ecs: true
reload:
enabled: true
I looks like the configurations below filebat.*
are not recognized. My question is, should the config above work or not? And in case of running filebeat through the elastic-agent, can be made here config options like filebeat.logging.*
in parallel to agent.logging.*
?