# How does elastic agent configure filebeat **URL:** \ **Category:** Elastic Agent\ **Tags:** filebeat\ **Created:** [January 16, 2024, 4:21pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187 "2024-01-16T16:21:19Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![mbby](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mbby](https://discuss.elastic.co/u/mbby)\ **Post date:** [January 16, 2024, 4:21pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/1 "2024-01-16T16:21:19Z")
Hi, I've installed an agent and added a custom log integration to the policy. It's working but I'm wondering if there's some documentation which tells me: How does the agent configure filebeat? I searched in the filesystem for a configuration file but couldn't find one with my settings. So how does filebeat know that it needs to read an additional file? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 16, 2024, 4:27pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/2 "2024-01-16T16:27:51Z")
Are you using Fleet to mange your agents right? This is all done by fleet, it will create the configuration needed for each input, then send it to the agent, the configuration is stored encrypted in the agent data path. ---
**Author:** ![mbby](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mbby](https://discuss.elastic.co/u/mbby)\ **Post date:** [January 16, 2024, 4:42pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/3 "2024-01-16T16:42:02Z")
Yes, I'm using Fleet. But how does filebeat get the configuration? Is it able to read this encrypted data? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 16, 2024, 6:44pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/4 "2024-01-16T18:44:33Z")
> [@mbby](#): > > But how does filebeat get the configuration? Is it able to read this encrypted data? This is done by the Elastic Agent binary, I don't think this is documented, but basically the Elastic Agent will receive the integrations from fleet and will start the necessary inputs, depending on the integration it may start a filebeat process, or a packetbeat process, or a metricbeat process, it depends on the integration. ---
**Author:** ![mbby](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mbby](https://discuss.elastic.co/u/mbby)\ **Post date:** [January 17, 2024, 6:41am UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/5 "2024-01-17T06:41:26Z")
I could see the processes that were started by the Elastic Agent and I understand that the Elastic Agent gets its config from Fleet. But how does filebeat get its config from the Elastic Agent? Using a config-file? /opt/Elastic/Agent/data/elastic-agent-8d7885/install/filebeat-8.4.1-linux-x86\_64/filebeat -E setup.ilm.enabled=false -E setup.template.enabled=false -E management.enabled=true -E logging.level=debug -E gc\_percent=${FILEBEAT\_GOGC:100} -E filebeat.config.modules.enabled=false -E logging.level=info -E http.enabled=true -E http.host=unix:///opt/Elastic/Agent/data/tmp/default/filebeat/filebeat.sock -E logging.files.path=/opt/Elastic/Agent/data/elastic-agent-8d7885/logs/default -E logging.files.name=filebeat -E logging.files.keepfiles=7 -E logging.files.permission=0640 -E logging.files.interval=1h -E path.data=/opt/Elastic/Agent/data/elastic-agent-8d7885/run/default/filebeat--8.4.1 There's nothing like a **-c** option to point to a config file or so. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 17, 2024, 12:29pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/6 "2024-01-17T12:29:16Z")
> [@mbby](#): > > But how does filebeat get its config from the Elastic Agent? > [@mbby](#): > > There's nothing like a **-c** option to point to a config file or so. This is not documented, you would need to see if someone from Elastic answer this or look at the Elastic Agent code to try to understand. But I wouldn't expect the filebeat, or any other beat, process started by the Elastic Agent to behave the same way that a standalone beat, so you may not need the `-c` option because the configuration may be passed to the filebeat sub-process in another way. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 17, 2024, 3:51pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/7 "2024-01-17T15:51:00Z")
Hi @mbby (and HI @leandrojmp) @mbby I am trying to understand what you are trying to accomplish, understand or correct. Yes, in general, Elastic Agent shares similarities/code with filebeat (and other beats), but there has been significant work under the covers of how integrations are configured, loaded executed etc. in Elastic Agent So no, there is no direct one-to-one mapping on how beats/modules are configured and executed. That said, many of the configuration settings are the same etc. If you want to learn more about how the Agent Work / see what is going on, I would look at the Elastic Agent [commands](https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html) In particular, [`elastic-agent inspect`](https://github.com/elastic/ingest-docs/edit/8.12/docs/en/ingest-management/commands.asciidoc) There is also a [troubleshooting](https://www.elastic.co/guide/en/fleet/current/fleet-troubleshooting.html) section that can provide insight of what is being configured etc. ---
**Author:** ![mbby](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mbby](https://discuss.elastic.co/u/mbby)\ **Post date:** [January 18, 2024, 7:06am UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/8 "2024-01-18T07:06:41Z")
Hi Stephen, it looks like the Elastic Agent is spinning up a filebeat process. But how does filebeat get it's config from the Elastic Agent? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 18, 2024, 3:00pm UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/9 "2024-01-18T15:00:10Z")
Hi @mbby Again, I'll ask you what you're actually trying to understand/accomplish? If you want to understand the actual process, you're going to need to look at the code. All of our code is open and you can see it. It's a multi-step process, I gave you the command so that you can inspect and see what's actually passed to. It's not as just as simple as a Copying a file. The config gets generated from several components comes down through the network and then through memory and eventually gets persisted I believe. > **[GitHub - elastic/elastic-agent: Elastic Agent - single, unified way to add...](https://github.com/elastic/elastic-agent)** > > Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host. - GitHub - elastic/elastic-agent: Elastic Agent - single, unified way to add monitoring f... ---
**Author:** ![mbby](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mbby](https://discuss.elastic.co/u/mbby)\ **Post date:** [January 19, 2024, 7:17am UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/10 "2024-01-19T07:17:22Z")
Ah. Thanks. This answers my question. Will have a look at the command and the code today. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 16, 2024, 7:18am UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187/11 "2024-02-16T07:18:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.