Fleet Managed Elastic Agent - add parameter to filebeat.yml

[lnx]

I need to set the scan_frequency config parameter for the Filebeat subprocess of Elastic Agent running on Windows managed by Fleet. I'm using the IIS integration.

I would like to try to reduce CPU usage.

How do I do this?

[stephenb (Stephen Brown)]

Which integration?

[lnx]

Hi Stephen, thanks - I'm using the IIS integration.

[stephenb (Stephen Brown)]

Sorry I meant which of the datasets

Can you show me the equivalent beats integration / data set

Collect IIS access and error logs (input: log)

If you are talking about

scan_frequency

How often Filebeat checks for new files in the paths that are specified for harvesting. For example, if you specify a glob like /var/log/*, the directory is scanned for files using the frequency specified by scan_frequency. Specify 1s to scan the directory as frequently as possible without causing Filebeat to scan too frequently. We do not recommend to set this value <1s.

If you require log lines to be sent in near real time do not use a very low scan_frequency but adjust close_inactive so the file handler stays open and constantly polls your files.

The default setting is 10s.

I an not sure that you can set that today with fleet managed agent ... '
You could try to "hack it in" in the processors settings but pretty sure that will not work

If it is really important you may need to use Stand Alone Agent...

Also I am just now looking at 8.5 where there is the new experimental Fleet API perhaps through that.

Collect IIS application_pool, webserver and website metrics

You can change the collection interval for this right in the UI.