- Fleet and Elastic Agent Guide: other versions:
- Fleet and Elastic Agent overview
- Beats and Elastic Agent capabilities
- Quick starts
- Migrate from Beats to Elastic Agent
- Deployment models
- Install Elastic Agents
- Install Fleet-managed Elastic Agents
- Install standalone Elastic Agents
- Install Elastic Agents in a containerized environment
- Run Elastic Agent in a container
- Run Elastic Agent on Kubernetes managed by Fleet
- Install Elastic Agent on Kubernetes using Helm
- Example: Install standalone Elastic Agent on Kubernetes using Helm
- Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm
- Advanced Elastic Agent configuration managed by Fleet
- Configuring Kubernetes metadata enrichment on Elastic Agent
- Run Elastic Agent on GKE managed by Fleet
- Run Elastic Agent on Amazon EKS managed by Fleet
- Run Elastic Agent on Azure AKS managed by Fleet
- Run Elastic Agent Standalone on Kubernetes
- Scaling Elastic Agent on Kubernetes
- Using a custom ingest pipeline with the Kubernetes Integration
- Environment variables
- Run Elastic Agent as an OTel Collector
- Run Elastic Agent without administrative privileges
- Install Elastic Agent from an MSI package
- Installation layout
- Air-gapped environments
- Using a proxy server with Elastic Agent and Fleet
- Uninstall Elastic Agents from edge hosts
- Start and stop Elastic Agents on edge hosts
- Elastic Agent configuration encryption
- Secure connections
- Manage Elastic Agents in Fleet
- Configure standalone Elastic Agents
- Create a standalone Elastic Agent policy
- Structure of a config file
- Inputs
- Providers
- Outputs
- SSL/TLS
- Logging
- Feature flags
- Agent download
- Config file examples
- Grant standalone Elastic Agents access to Elasticsearch
- Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
- Example: Use standalone Elastic Agent with Elasticsearch Service to monitor nginx
- Debug standalone Elastic Agents
- Kubernetes autodiscovery with Elastic Agent
- Monitoring
- Reference YAML
- Manage integrations
- Package signatures
- Add an integration to an Elastic Agent policy
- View integration policies
- Edit or delete an integration policy
- Install and uninstall integration assets
- View integration assets
- Set integration-level outputs
- Upgrade an integration
- Managed integrations content
- Best practices for integrations assets
- Data streams
- Define processors
- Processor syntax
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Command reference
- Troubleshoot
- Release notes
Create an agent policy without using the UI
editCreate an agent policy without using the UI
editFor use cases where you want to provide a default agent policy or support automation, you can set up an agent policy without using the Fleet UI. To do this, either use the Fleet API or add a preconfigured policy to Kibana:
Option 1. Create an agent policy with the API
editcurl -u <username>:<password> --request POST \ --url <kibana_url>/api/fleet/agent_policies?sys_monitoring=true \ --header 'content-type: application/json' \ --header 'kbn-xsrf: true' \ --data '{"name":"Agent policy 1","namespace":"default","monitoring_enabled":["logs","metrics"]}'
In this API call:
-
sys_monitoring=true
adds the system integration to the agent policy -
monitoring_enabled
turns on Elastic Agent monitoring
For more information, refer to Kibana Fleet APIs.
Option 2. Create agent policies with preconfiguration
editAdd preconfigured policies to kibana.yml
config.
For example, the following example adds a Fleet Server policy for self-managed setup:
xpack.fleet.packages: - name: fleet_server version: latest xpack.fleet.agentPolicies: - name: Fleet Server policy id: fleet-server-policy namespace: default package_policies: - name: fleet_server-1 package: name: fleet_server
The following example creates an agent policy for general use, and customizes the period
setting for the system.core
data stream. You can find all available inputs and variables in the Integrations app in Kibana.
xpack.fleet.packages: - name: system version: latest - name: elastic_agent version: latest xpack.fleet.agentPolicies: - name: Agent policy 1 id: agent-policy-1 namespace: default monitoring_enabled: - logs - metrics package_policies: - package: name: system name: System Integration 1 id: preconfigured-system-1 inputs: system-system/metrics: enabled: true vars: '[system.hostfs]': home/test streams: '[system.core]': enabled: true vars: period: 20s system-winlog: enabled: false
For more information about preconfiguration settings, refer to the Kibana documentation.
On this page