Elastic-agent: output by integration and not by policy

Elastic Stack Elastic Agent
1

Hi,
i have an instance of elastic-agent on a server where i have multiple integrations. for most of them I need the Elasticsearch output. But, I also have some log files on that server which I want to send to Logstash for parsing.
The issue is that the agent output is set on the agent-policy level and not on integration level, thus limiting each agent to only one output format (according to documentation there can only be single policy per agent).

Is there a way to combine outputs or will I have to install Filebeat standalone in addition to Elastic-Agent on this server in order to harvest these log files and send to LS?

Thanks,
Ofir

1 Like
2

There is none, the output is per policy, so every integration in that policy will use the same output.

You will need to run a standalone filebeat instance to collect those logs and send to Logstash.

3

Thanks for the reply @leandrojmp

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.