Elastic Agent to Logstash

Elastic Stack Logstash
1
  • I cant send the elastic agent to logstash
  • I have the logstash listed in Fleet → Settings
  • While creating a policy, while selecting output for integration, the logstash option is available but not clickable
2

Hello @arav

Welcome to the Community!!

Could you please provide more details about the usecase ? You have installed elastic-agent on a Logstash node ? What is your ELK version ?

Thanks!!

3

I am running a fully self-managed Elastic Stack 9.3.1(Elasticsearch, Kibana, Fleet Server, Elastic Agent, and Logstash).

Logstash is installed and listening on port 5044, Elastic Agents as input.

In Fleet → Settings → Outputs, I successfully created a Logstash output.

However, when I go to Fleet → Agent Policies → [my policy] → Settings, in the Output dropdown, Logstash is not clickable.

This is happening even with a newly created agent policy.

I am logged in with superuser privileges.

Is there a configuration dependency (Fleet Server policy binding, preconfigured outputs in kibana.yml, version constraints, or Fleet health state) that would cause the output selector to be locked?

Or is this fully because of Licence issue?

Update : i had to change logstash as default in the output

4

Yes, the basic license does not allow you to have different outputs per policy, the default output is Elasticsearch and Fleet server requires an Elasticsearch output as it does not work with an Logstash.

The alternative is what you did, set Logstash as the default output, then Fleet will use the Elasticsearch output without any issue related to the license.