Standalone mode, Logstash, Kafka and OpenTelemetry (EDOT)

1. Standalone configuration #

Everything in elastic-agent.yml.

Minimal example #

outputs:
  default:
    type: elasticsearch
    hosts: ["https://es.exemple.fr:9200"]
    api_key: "${ES_API_KEY}"
    ssl.certificate_authorities: [/etc/pki/ca.crt]
inputs:
  - id: system-logs
    type: filestream
    use_output: default
    data_stream.namespace: prod
    streams:
      - id: syslog
        data_stream.dataset: system.syslog
        paths: [/var/log/syslog, /var/log/messages]
  - id: system-metrics
    type: system/metrics
    use_output: default
    data_stream.namespace: prod
    streams:
      - metricsets: [cpu, memory, filesystem, network]
        data_stream.dataset: system.cpu
        period: 30s

Good to know: In standalone mode, install integration assets (pipelines, mappings, dashboards) from Kibana › Integrations › Settings, otherwise data arrives unstructured.

2. Logstash and Kafka outputs #

When to use an intermediary.

Choosing #

Logstash #

# Logstash : entrée dédiée aux agents
input {
  elastic_agent { port => 5044 ssl_enabled => true ssl_certificate => "/etc/pki/ls.crt" ssl_key => "/etc/pki/ls.key" }
}
output {
  elasticsearch { hosts => ["https://es.exemple.fr:9200"] data_stream => true api_key => "${LS_API_KEY}" }
}

3. OpenTelemetry with EDOT #

The Collector distributed by Elastic.

The otel mode #

Elastic publishes EDOT (Elastic Distribution of OpenTelemetry): a Collector and SDKs supported by Elastic. The Elastic Agent binary can run this Collector with elastic-agent otel: data is stored in native OpenTelemetry format (resource.attributes.*, attributes.* fields) in dedicated data streams.

sudo elastic-agent otel --config /etc/elastic-agent/otel.yml
# ou valider la configuration
elastic-agent otel validate --config /etc/elastic-agent/otel.yml

Depending on the version: Elastic Agent's OpenTelemetry mode and Fleet management of EDOT evolve quickly between 8.x and 9.x: check your version's documentation before using it in production. The « OpenTelemetry and Elasticsearch » chapter of the Elasticsearch course details the configurations.