Elastic-Agent vs Metricbeat standalone

Elastic Security
1

Hi,

Note: Running in Windows Server 2012

I have a couple of questions about the Metricbeat service running under Elastic-Agent:

  1. Can modules (for example MSSQL) be activated like the standalone version of Metricbeat?
  2. How do I load the dashboards in Kibana? Should I modify the file C:\Program Files\Elastic-Agent\data\install\metricbeat-7.9.2-windows-x86_64\metricbeat.yml to add the connection information and be able to run command .\metricbeat.exe setup?
  3. After installing Elastic-Agent I don't see that an index like metricbeat-7.9.2-x has been created in Elasticsearch. Apparently this Metricbeat sends data only to index .ds-metrics-elastic.agent.metricbeat-default. I assume that the preconfigured dashboards that the Metricbeat installation incorporates will not have data to show, since it reads from the index metricbeat-7.9.2-x that is not being created?
  4. If this Metricbeat does not allow me (due to the previous questions) to make use of the dashboards and the MSSQL data I want to monitor, can I install a standalone version of Metricbeat on the same machine where Elastic-Agent is running, without both Metricbeat processes coming into conflict?

Note: I acknowledge that this topic is about beats and I considered putting it in the Beats section, but since these are specific questions about beasts running under Elastic-Agent, I think it makes more sense to post it in this section. Please forgive me if I'm wrong.

Thank you

2
  1. Not currently that I have found. If you do find it please share. They have mentioned it. Think one agent to rule them all but it's still "beta" for ingest manager. Best to stick with the beats for SQL for awhile as that's a tested method and you don't want to loss data.
  2. Not currently an option that's documented but should be coming in soon.
  3. Create and index called metric-* and you'll be able to see them. Between the default metricbeat and metrics you will end up with a conflict in the index on host.ip if you have an older beat sending still to metricbeat.
  4. Yes. Disable duplicate options "cpu, ram, disk io" in system in the metricbeat so your not getting duplicate data it helps drastically in terms of performance. I forgot that one a few times.... This is only required on 2012/2012r2. On 2016+ you can disable system completely and you will get metrics.

As a word of friendly advise start going through your visualizations and adding metric-* to them after you create the index so you can slow roll the move over to the ingest agent. The beats will still be around for a long time for custom data import.

Elastic-Agent isn't Elastic Security. That is Elastic Endpoint which is another part of the ingest manager. So many things to keep tabs on....

3

Hi @PublicName, and thank you for taking your time to answer my questions. Here a few comments:

  • I did modify file C:\Program Files\Elastic-Agent\data\install\metricbeat-7.9.2-windows-x86_64\metricbeat.yml temporarily to add connection information. After that I was able to run command .\metricbeat.exe setup. Metricbeat dashboards where successfully loaded into Kibana and index metricbeat-7.9.2-x was created as part of the process. After that I reverted the changes in the .yml file. The setup process worked fine, but the index metricbeat-7.9.2-x is not receiving any data because the Metricbeat process running under Elastic-Agent apparently only ships data to index .ds-metrics-elastic.agent.metricbeat-default. So even when I was able to get the dashboards and index, they are useless.

  • Ended up (for now) disabling the system integration for this server. Then installed the standalone Metricbeat, which is working fine.

4

Well that's one way of doing it. Was hoping for a more gui driven based as it can be updated from the gui side.

Create a index pattern metric.* and you will see the metrics. That will cover the different ones all the data goes into.

5

Feel free to correct me if I'm wrong but in 7.11.2 it seems like the metricbeat dashboards that we're used to can now be found in the [Metrics System] Overview instead of the [Metricbeat System] Overview. In other words, [Metrics System] Overview = [Metricbeat System] Overview when utilizing the Elastic Agent.