Elastic Agent System Integration

Elastic Stack Beats
,
1

The Elastic Agent collects Filebeat logs. Within 'Fleet' I have the system-1 default. This module collects the logs form usual logfiles like /var/log/syslog* etc.
But also the logs from /var/lib/elastic-agent/logs/default/filebeat-json.log. Now I have all events duplicated. The latter ones are not parsed, the logs from /var/log are correctly parsed.

Why are there logs also collected?

Thanks,
Herman

2

We definitively should not ship the logs twice. @blaker Could you comment on this?

3

That is because of elastic/beats#19179. We need to fix the logging we start filebeat and metricbeat with so that every published event is not logged.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.