- Fleet and Elastic Agent Guide: other versions:
- Fleet and Elastic Agent overview
- Beats and Elastic Agent capabilities
- Quick starts
- Migrate from Beats to Elastic Agent
- Deployment models
- Install Elastic Agents
- Install Fleet-managed Elastic Agents
- Install standalone Elastic Agents
- Install Elastic Agents in a containerized environment
- Run Elastic Agent in a container
- Run Elastic Agent on Kubernetes managed by Fleet
- Advanced Elastic Agent configuration managed by Fleet
- Configuring Kubernetes metadata enrichment on Elastic Agent
- Run Elastic Agent on GKE managed by Fleet
- Run Elastic Agent on Amazon EKS managed by Fleet
- Run Elastic Agent on Azure AKS managed by Fleet
- Run Elastic Agent Standalone on Kubernetes
- Scaling Elastic Agent on Kubernetes
- Using a custom ingest pipeline with the Kubernetes Integration
- Environment variables
- Run Elastic Agent as an OTel Collector
- Run Elastic Agent without administrative privileges
- Install Elastic Agent from an MSI package
- Installation layout
- Air-gapped environments
- Using a proxy server with Elastic Agent and Fleet
- Uninstall Elastic Agents from edge hosts
- Start and stop Elastic Agents on edge hosts
- Elastic Agent configuration encryption
- Secure connections
- Manage Elastic Agents in Fleet
- Configure standalone Elastic Agents
- Create a standalone Elastic Agent policy
- Structure of a config file
- Inputs
- Providers
- Outputs
- SSL/TLS
- Logging
- Feature flags
- Agent download
- Config file examples
- Grant standalone Elastic Agents access to Elasticsearch
- Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
- Example: Use standalone Elastic Agent with Elasticsearch Service to monitor nginx
- Debug standalone Elastic Agents
- Kubernetes autodiscovery with Elastic Agent
- Monitoring
- Reference YAML
- Manage integrations
- Define processors
- Processor syntax
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Command reference
- Troubleshoot
- Release notes
Configure standalone Elastic Agents
editConfigure standalone Elastic Agents
editTo get started quickly, use Kibana to create and download a standalone policy file. You’ll still need to deploy and manage the file, though. For more information, refer to Create a standalone Elastic Agent policy or try out our example: Use standalone Elastic Agent to monitor nginx.
Standalone Elastic Agents are manually configured and managed locally on the systems where they are installed. They are useful when you are not interested in centrally managing agents in Fleet, either due to your company’s security requirements, or because you prefer to use another configuration management system.
To configure standalone Elastic Agents, specify settings in the elastic-agent.yml
policy file deployed with the agent. Prior to installation,
the file is located in the extracted Elastic Agent package. After installation, the
file is copied to the directory described in Installation layout. To apply
changes after installation, you must modify the installed file.
For installation details, refer to Install standalone Elastic Agents.
Alternatively, you can put input configurations in YAML files into the
folder {path.config}/inputs.d
to separate your configuration into
multiple smaller files.
The YAML files in the inputs.d
folder should contain input configurations only.
Any other configurations are ignored.
The files are reloaded at the same time as the standalone configuration.
The first line of the configuration must be inputs
. Then you can list the
inputs you would like to run. Each input in the policy must have a unique value
for the id
key. If the id
key is missing its value defaults to the empty
string ""
.
inputs: - id: unique-logfile-id type: logfile data_stream.namespace: default paths: [/path/to/file] use_output: default - id: unique-system-metrics-id type: system/metrics data_stream.namespace: default use_output: default streams: - metricset: cpu data_stream.dataset: system.cpu
The following sections describe some settings you might need to configure to run an Elastic Agent standalone. For a full reference example, refer to the elastic-agent.reference.yml file.
The settings described here are available for standalone Elastic Agents. Settings for Fleet-managed agents are specified through the UI. You do not set them explicitly in a policy file.