Skip to content

Commit 9548faf

Browse files
authored
Document agent.internal and otel overrides. (#11486)
1 parent 19fff00 commit 9548faf

File tree

1 file changed

+42
-4
lines changed

1 file changed

+42
-4
lines changed

docs/hybrid-agent-beats-receivers.md

Lines changed: 42 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,21 +45,32 @@ collector configuration used to run the Beat receivers.
4545

4646
The capability to use Beat receivers is being enabled on per Beat and per input type basis. At the time of writing (August 2025),
4747
Filebeat and Metricbeat can run as receivers and both the `filestream` and `system/metrics` inputs work outside of
48-
monitoring use cases. An example showing how to set the feature flag to run the `filestream` and `system/metrics` inputs as Beat
49-
receivers follows below.
48+
monitoring use cases.
49+
50+
With the changes in https://github.com/elastic/elastic-agent/pull/11186 a new `agent.internal.runtime` section allows controlling
51+
the default runtime where `otel` indicates the input should run as a receiver. The default can be controlled on a per Beat and per
52+
input basis. For example to run the `filestream` and `system/metrics` inputs as Beat receivers:
5053

5154
```yaml
55+
agent:
56+
internal:
57+
runtime:
58+
default: process # Run all beats and inputs as sub-processes unless overridden below.
59+
filebeat:
60+
default: process # Run all Filebeat inputs as sub-processe unless overidden individually.
61+
filestream: otel # Run the Filebeat filestream input as a beat receiver.
62+
metricbeat:
63+
default: process # Run all Metricbeat inputs as sub-processe unless overidden individually.
64+
system/metrics: otel # Run the Metricbeat system/metrics input as a beat receiver.
5265
inputs:
5366
- id: system-metrics-receiver
5467
type: system/metrics
55-
_runtime_experimental: otel
5668
streams:
5769
- metricsets:
5870
- cpu
5971
data_stream.dataset: system.cpu
6072
- id: filestream-receiver
6173
type: filestream
62-
_runtime_experimental: otel
6374
data_stream.dataset: generic
6475
paths:
6576
- /var/log/*.log
@@ -70,6 +81,33 @@ outputs:
7081
api_key: placeholder
7182
```
7283

84+
### Configuration Translation Overrides
85+
86+
When an input is executed as a Beat receiver, it is injected into an OpenTelemetry collector pipeline that was
87+
generated based on the associated output. The `ssl`, `proxy*`, and other transport settings are added to a generated
88+
[beatsauth extension](https://github.com/elastic/beats/tree/da79b6ecce2fd9cc9403f8041aea10616ba93c57/x-pack/otel/extension/beatsauthextension)
89+
instance which allows the collector to use the Beat SSL settings and underlying HTTP transport to guarantee the behavior is the same as before.
90+
Similarly, when using the Elasticsearch output an [elasticsearch exporter](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/elasticsearchexporter)
91+
instance is generated with a configuration equivalent to the previous Elasticsearch output in Beats using the `bodymap` mapping mode to
92+
continue to generate ECS documents.
93+
94+
The changes in https://github.com/elastic/elastic-agent/pull/10992 added a way to override or extend the translated beatsauth extension and
95+
elasticsearch exporter parameters in case there is a problem or bug with the translation process. For example:
96+
97+
```yaml
98+
outputs:
99+
default:
100+
type: elasticsearch
101+
hosts: [127.0.0.1:9200]
102+
api_key: "example-key"
103+
otel:
104+
extensions:
105+
beatsauth:
106+
timeout: "60s" # Override the connection timeout from the translated value.
107+
exporter:
108+
include_source_on_error: false # Override the generated value of include_source_on_error.
109+
```
110+
73111
## Hybrid Agent
74112

75113
**Hybrid Agent** refers the capability of Elastic Agent to run OpenTelemetry collector pipelines specified directly in

0 commit comments

Comments
 (0)