Where are Elastic Agent logs parsed

I've got a question about elastic agent. Are the logs collected by the agent parsed on the host right away or is it done in elasticsearch ingest node?

Hi @sideyourspirit Welcome to the community.

Unfortunately it depends on the integration, it is not completely consistent.

Some are parsed on the ingest node, some are parsed at the agent, I believe some are a combination.

Which integration(s) are you interested in?

1 Like

Hello @stephenb
Thank you for your anwser. I don't have a speccific integration in mind right now, but is there a place in documentation I can find the information about the parsing location?
It's always good to know where to search :slight_smile:

No there is not ... You will need to look closely at the module...

I some sense pre-built integration are supposed to be setup and go.. use need not be concerned with internals , of course all the code / config is open for viewing and after you look at couple you will be able to understand how they work.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.