Elastic Agent or Beats?

1. Comparison #

What actually changes.

Comparison table #

When to keep Beats? #

• Highly customised configurations with no equivalent integration (exotic modules, complex processors).
• Environments frozen on an old stack version.
• Need for a minimal binary without a supervisor, e.g. in a very constrained image.

2. Migrating step by step #

With no loss or duplicates.

The method #

1. Inventory the Beats, their modules and processors.
2. Pick the equivalent integration for each module (System, Nginx, Windows, Custom Logs…).
3. Create a test policy, carrying over file paths and added fields.
4. Install the agent on a pilot host alongside the Beat and compare the documents produced.
5. Stop the Beat, then roll out in batches.

Common mistake: Running Filebeat and the logs integration on the same files: every line is indexed twice. For continuity, recent versions offer a Filebeat registry state migration option: check it before switching.

Data and dashboards #

Beats write to filebeat-* or metricbeat-*, Elastic Agent to logs-* and metrics-* data streams. Update data views, alerting rules and custom dashboards that targeted the old indices.