1. Comparison #
What actually changes.
Comparison table #
| Criterion | Beats | Elastic Agent |
|---|---|---|
| Installation | One binary per data type | A single agent |
| Configuration | YAML files per host | Central policy (Fleet) or standalone YAML |
| Pipelines and dashboards | Installed by setup | Provided by the integration |
| Upgrades | Manual, host by host | From Fleet, in batches |
| Security (EDR) | No | Elastic Defend |
| OpenTelemetry | No | Yes (EDOT mode, depending on version) |
When to keep Beats? #
- Highly customised configurations with no equivalent integration (exotic modules, complex processors).
- Environments frozen on an old stack version.
- Need for a minimal binary without a supervisor, e.g. in a very constrained image.
2. Migrating step by step #
With no loss or duplicates.
The method #
- Inventory the Beats, their modules and processors.
- Pick the equivalent integration for each module (System, Nginx, Windows, Custom Logs…).
- Create a test policy, carrying over file paths and added fields.
- Install the agent on a pilot host alongside the Beat and compare the documents produced.
- Stop the Beat, then roll out in batches.
Common mistake: Running Filebeat and the logs integration on the same files: every line is indexed twice. For continuity, recent versions offer a Filebeat registry state migration option: check it before switching.
Data and dashboards #
Beats write to filebeat-* or metricbeat-*, Elastic Agent to logs-* and metrics-* data streams. Update data views, alerting rules and custom dashboards that targeted the old indices.
