How to configure Elastic Agent to stream different data to different instances of ElasticSearch?

Elastic Stack Beats
1

Hi

How do you configure Elastic Agent to stream security logs to a dedicated instance of Elasticsearch and other data to a different instance of ElsticSearch? I want two segregated instances of Elasticsearch: one dedicated to support SIEM functionality; second to support obervability/enterprise system performance monitoring. I want to avoid performance monitoring impacting the operational performance of the SIEM functionality.

Thanks.

2

From Elastic Search to Beats

3

Added elastic-agent

4

Hi @starstone

Today (8.15.2), Elastic Agent can only ship telemetry to a single output per Agent / Fleet Policy, even when the policy has multiple integrations. That is an Elastic Agent limitation.

However if you look/follow this issue you will you will see that the feature for defining and output per integration well under development. You can follow this. We do not announce future feature release dates on this discuss forum.

You can also create an architecture like

Elastic Agent -> Logstash -> To Many Elasticsearch Clusters

5

@stephenb Thanks for the advice. I get it. I look forward to the release of the new enhancement.

1 Like