Set custom ID for elastic-agent

Elastic Security Endpoint Security
1

Hello,

Is it possible to set or create a custom agent.id during or after the elastic-agent install, whether it be via a command line argument or an API call we can make?

For example, instead of agent.id being a uuid like e9cdb5af-1585-4646-abad-4895668bb5cb could we instead make it into a custom base64 encoded value?

Thanks

2

Hi @bm11100

No that isn't a supported feature.

3

@bm11100 are you able to elaborate on why you want to do that?

4

@mukeshelastic it doesn't necessarily have to be agent.id.

It could be ANY custom field that would be in all Endpoint documents, for something like org.id or org, or anything like that which could be configured dynamically at install/runtime or via an API.

There's a bunch of additional fields I'd need to track which isn't a good fit for namespaces or policy names.

5

What about host.hostname?

6

@gabriel.landau interesting, so you are thinking use host.name which then leaves host.hostname as a duplicative value that we could populate with custom info?

That would work, in theory, but how would we go about populating that dynamically at install? Or were you thinking API call after the fact?

7

Sorry I should have been clearer. Elastic Endpoint populates host.hostname with the machine's host name, which is a value you can control.

8

@bm11100 Is this specific metadata that you want to add to some agents in a single agent policy? For example, you have a single agent policy that includes endpoint agents deployed on laptops of org1, org2 and then you want to add org as a metadata key and assign values org1 to laptops of org1 and similar for org2. Either at install time or after it has been installed through some api call.

If yes, we don't support that yet but it would be great if you could file an enhancement Issues · elastic/beats · GitHub

Today, the only way you could do that is by create different agent policies per org and including them in policy name or provide org names in namespaces when you create agent policies.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.