Configure APM instrumentation

Libbeat uses the Elastic APM Go Agent to instrument its publishing pipeline. Currently, only the Elasticsearch output is instrumented. To gain insight into the performance of Auditbeat, you can enable this instrumentation and send trace data to APM Server.

Example configuration with instrumentation enabled:

instrumentation:
  enabled: true
  environment: production
  hosts:
    - "http://localhost:8200"
  api_key: L5ER6FEvjkmlfalBealQ3f3fLqf03fazfOV

You can specify the following options in the instrumentation section of the auditbeat.yml config file:

Set to true to enable instrumentation of Auditbeat. Defaults to false.

Set the environment in which Auditbeat is running, for example, staging, production, dev, etc. Environments can be filtered in the APM app.

The APM Server hosts to report instrumentation data to. Defaults to http://localhost:8200.

API key used to secure communication with the APM Server(s). If api_key is set then secret_token will be ignored.

Secret token used to secure communication with the APM Server(s).

Set to true to enable CPU profiling, where profile samples are recorded as events.

This feature is experimental.

Configure the CPU profiling interval. Defaults to 60s.

This feature is experimental.

Configure the CPU profiling duration. Defaults to 10s.

This feature is experimental.

Set to true to enable heap profiling.

This feature is experimental.

Configure the heap profiling interval. Defaults to 60s.

This feature is experimental.