I'm currently using various *beats deployed to servers and clients. For a number of reasons, I have my beats output to logstash, before they are sent to Elasticsearch. I'm evaluating elastic-agent, to at least replace the *beats at the clients, as I see it, elastic-agent doesn't (yet?) support output sent to logstash?
Currently I've deployed osquery on servers and clients. osqueryd is reporting back to a kolide fleet server, where the logs are picked up by filebeat and sent to logstash -> Elasticsearch.
using the osquery-manager integration for the clients, osquery on them will report directly to the fleet server, not to kolide anymore, great.
However, the servers would still be connected to the kolide osquery server, having them split is just impractical, meaning, have to keep maintaining the kolide fleet server for the servers, and when investigating, i.e. to run live queries, have to visit two UIs, and combine output etc. That would just be cumbersome and impractical.
The osquerybeat is not mentioned here: What are Beats? | Beats Platform Reference [7.14] | Elastic , however, I could grab the tarball from a host with elastic-agent running that has fetched it, and install it on other hosts. I guess I'd have to point it to the fleet server, to actually being able to run live queries?
Or is it possible to keep the current separately installed *beats for the server, and just add a elastic-agent to these nodes, with only the osquery-manager integration for the servers? Then the let's call them legacy *beats could continue to output to logstash, and only the elastic-agent with osquerybeat would connect to the elastic fleet server. Would that be a viable solution?
my main motivation is to potentially get rid of the kolide fleet server, and having all osquery related stuff well integrated into kibana.