In my ELK stack deployment I have for most agent policies the System integration set with the "Collect metrics from System instances" enabled as can be seen below:
Recently I saw that there is a setting to enable logs and metrics for all agents in the group policy. That setting is in the general settings for the group policy:
So it states that will create the Elastic Agent integration (elastic_agent dataset) with the default namespace above.
So how is it different from collecting logs and metrics from the System integration and which is superior or best to use?
I don't want to have duplicate information and I tend to believe that the data in Elastic Agent integration is just that.
Lastly when I checked the data I saw that the underneath modules collecting the data were the filebeat, metricbeat, etc modules.
Any thoughts on this? Thanks in advance