Since I didn’t see it documented anywhere else, one way to get the Elastic Fleet integration to work with Windows OCS (Kubernetes) and successfully capture the logs in ECS is to install the agent at the node level, then set the Elastic Service’s registry keys to include the same vars you’d need to set at Agent enrollment time, using the standard windows agent enrollment with token process for fleet.
Vars:
NODE_NAME = $(hostname)
KUBECONFIG = (path to a known-good kubeconfig file)
You’ll probably want to download kubectl or ‘oc’ for Openshift to verify the kubeconfig file is valid prior to using it.
In the additional processing section, you can apply some pre-parsing parameters.
In the Container parser's format configuration of the kubernetes integration config, try setting to CRI if that is the parser you need. Auto may or may not work.
Multiline as needed.
I hope this helps!