It is possible to change the bulk_max_size and workers on a fleet managed agent?

Elastic Stack Elastic Agent
1

Hello,

I'm using Elastic Agent with the AWS Cloudwatch integration to consume some logs, the volume of logs are pretty high and I'm trying to improve the performance of the Elastic Agent.

Filebeat per default uses just 1 worker and has a bulk_max_size of 50, which in my use case is not suited for production, normally on Filebeat I would simple edit the filebeat.yml and increase the number of workers and the bulk max size, how can I do the same with the Elastic Agent?

I looked in the fleet interface and didn't find a way to edit those settings, the documentation also is not clear on how to edit those settings on a fleet managed agent.

So, the question is, how can I change the workers and bulk_max_size for the elasticsearch output on a fleet managed agent?

2

Just found that it needs to be done manually on the Advanced Yaml configuration.

1 Like
3

I think those are going to be added to UI / API config sometime soon... but I don't see them yet...

4

Hi Leandro,

Would it be possible to post there how exactly should look the section?

Just like this:

bulk_max_size: 1000

or with some other section like:

output.elasticsearch:
   bulk_max_size: 1000

Regards,
Igor

5

You need to edit the output in the Fleet Settings and just add the configs you want in the Advanced YAML configuration box.

For example:

worker: 2
bulk_max_size: 125
1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.