- Fleet and Elastic Agent Guide: other versions:
- Fleet and Elastic Agent overview
- Beats and Elastic Agent capabilities
- Quick starts
- Migrate from Beats to Elastic Agent
- Deployment models
- Install Elastic Agents
- Install Fleet-managed Elastic Agents
- Install standalone Elastic Agents
- Install Elastic Agents in a containerized environment
- Run Elastic Agent in a container
- Run Elastic Agent on Kubernetes managed by Fleet
- Install Elastic Agent on Kubernetes using Helm
- Example: Install standalone Elastic Agent on Kubernetes using Helm
- Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm
- Advanced Elastic Agent configuration managed by Fleet
- Configuring Kubernetes metadata enrichment on Elastic Agent
- Run Elastic Agent on GKE managed by Fleet
- Run Elastic Agent on Amazon EKS managed by Fleet
- Run Elastic Agent on Azure AKS managed by Fleet
- Run Elastic Agent Standalone on Kubernetes
- Scaling Elastic Agent on Kubernetes
- Using a custom ingest pipeline with the Kubernetes Integration
- Environment variables
- Run Elastic Agent as an OTel Collector
- Run Elastic Agent without administrative privileges
- Install Elastic Agent from an MSI package
- Installation layout
- Air-gapped environments
- Using a proxy server with Elastic Agent and Fleet
- Uninstall Elastic Agents from edge hosts
- Start and stop Elastic Agents on edge hosts
- Elastic Agent configuration encryption
- Secure connections
- Manage Elastic Agents in Fleet
- Configure standalone Elastic Agents
- Create a standalone Elastic Agent policy
- Structure of a config file
- Inputs
- Providers
- Outputs
- SSL/TLS
- Logging
- Feature flags
- Agent download
- Config file examples
- Grant standalone Elastic Agents access to Elasticsearch
- Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
- Example: Use standalone Elastic Agent with Elasticsearch Service to monitor nginx
- Debug standalone Elastic Agents
- Kubernetes autodiscovery with Elastic Agent
- Monitoring
- Reference YAML
- Manage integrations
- Package signatures
- Add an integration to an Elastic Agent policy
- View integration policies
- Edit or delete an integration policy
- Install and uninstall integration assets
- View integration assets
- Set integration-level outputs
- Upgrade an integration
- Managed integrations content
- Best practices for integration assets
- Data streams
- Define processors
- Processor syntax
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Command reference
- Troubleshoot
- Release notes
Set integration-level outputs
editSet integration-level outputs
editIf you have an Enterprise Elastic Stack subscription, you can configure Elastic Agent data to be sent to different outputs for different integration policies. Note that the output clusters that you send data to must also be on the same subscription level.
Integration-level outputs are very useful for certain scenarios. For example:
- You can may want to send security logs monitored by an Elastic Agent to one Logstash output, while informational logs are sent to a another Logstash output.
- If you operate multiple Beats on a system and want to migrate these to Elastic Agent, integration-level outputs enable you to maintain the distinct outputs that are currently used by each Beat.
Order of precedence
editFor each Elastic Agent, the agent policy configures sending data to the following outputs in decreasing order of priority:
- The output set in the integration policy.
- The output set in the integration’s parent Elastic Agent policy. This includes the case where an integration policy belongs to multiple Elastic Agent policies.
- The global, default data output set in the Fleet settings.
Configure the output for an integration policy
editTo configure an integration-level output for Elastic Agent data:
- In Kibana, go to Integrations.
- On the Installed integrations tab, select the integration that you’d like to update.
- Open the Integration policies tab.
- From the Actions menu next to the integration, select Edit integration.
- In the integration settings section, expand Advanced options.
- Use the Output dropdown menu to select an output specific to this integration policy.
- Click Save and continue to confirm your changes.
View the output configured for an integration
editTo view which Elastic Agent output is set for an integration policy:
- In Fleet, open the Agent policies tab.
- Select an Elastic Agent policy.
- On the Integrations tab, the Output column indicates the output used for each integration policy. If data is configured to be sent to either the global output defined in Fleet settings or to the integration’s parent Elastic Agent policy, this is indicated in a tooltip.
On this page
Was this helpful?
Thank you for your feedback.