diff --git a/NOTICE-fips.txt b/NOTICE-fips.txt
index f9cf2ca136..22681d3d58 100644
--- a/NOTICE-fips.txt
+++ b/NOTICE-fips.txt
@@ -661,11 +661,11 @@ SOFTWARE
 
 --------------------------------------------------------------------------------
 Dependency : github.com/elastic/elastic-agent-libs
-Version: v0.21.4
+Version: v0.21.6
 Licence type (autodetected): Apache-2.0
 --------------------------------------------------------------------------------
 
-Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.21.4/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.21.6/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
diff --git a/NOTICE.txt b/NOTICE.txt
index e472cfbc68..5918d62508 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -661,11 +661,11 @@ SOFTWARE
 
 --------------------------------------------------------------------------------
 Dependency : github.com/elastic/elastic-agent-libs
-Version: v0.21.4
+Version: v0.21.6
 Licence type (autodetected): Apache-2.0
 --------------------------------------------------------------------------------
 
-Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.21.4/LICENSE:
+Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.21.6/LICENSE:
 
                                  Apache License
                            Version 2.0, January 2004
diff --git a/go.mod b/go.mod
index f4ef99120d..59755454ca 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/dgraph-io/ristretto v0.2.0
 	github.com/docker/go-units v0.5.0
 	github.com/elastic/elastic-agent-client/v7 v7.17.2
-	github.com/elastic/elastic-agent-libs v0.21.4
+	github.com/elastic/elastic-agent-libs v0.21.6
 	github.com/elastic/elastic-agent-system-metrics v0.11.18
 	github.com/elastic/go-elasticsearch/v8 v8.19.0
 	github.com/elastic/go-ucfg v0.8.8
diff --git a/go.sum b/go.sum
index 5920eaf5ea..1fc8280280 100644
--- a/go.sum
+++ b/go.sum
@@ -35,8 +35,8 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/elastic/elastic-agent-client/v7 v7.17.2 h1:Cl2TeABqWZgW40t5fchGWT/sRk4MDDLWA0d8iHHOxLA=
 github.com/elastic/elastic-agent-client/v7 v7.17.2/go.mod h1:5irRFqp6HLqtu1S+OeY0jg8x7K6PLL+DW+PwVk1vJnk=
-github.com/elastic/elastic-agent-libs v0.21.4 h1:Xf7zeJ2hiyt13VRhyH22/nsDmlY8/TEfFb36X9uvw34=
-github.com/elastic/elastic-agent-libs v0.21.4/go.mod h1:xSeIP3NtOIT4N2pPS4EyURmS1Q8mK0lWZ8Wd1Du6q3w=
+github.com/elastic/elastic-agent-libs v0.21.6 h1:hvBAi4KHaYf4hn+rTc9m6A35eZjqb1uoE2exklIdWm0=
+github.com/elastic/elastic-agent-libs v0.21.6/go.mod h1:xSeIP3NtOIT4N2pPS4EyURmS1Q8mK0lWZ8Wd1Du6q3w=
 github.com/elastic/elastic-agent-system-metrics v0.11.18 h1:MuFLvHc3kQN/59+3KmRWhOUoXkL5PDzxEbdYbARGexA=
 github.com/elastic/elastic-agent-system-metrics v0.11.18/go.mod h1:qiZC5p1hd8te4XVnhh7FkXdcYhxFnl5i9GJpROtf6zo=
 github.com/elastic/elastic-transport-go/v8 v8.7.0 h1:OgTneVuXP2uip4BA658Xi6Hfw+PeIOod2rY3GVMGoVE=
diff --git a/internal/pkg/action/dispatcher.go b/internal/pkg/action/dispatcher.go
index c73f5bab17..44ec1f7e98 100644
--- a/internal/pkg/action/dispatcher.go
+++ b/internal/pkg/action/dispatcher.go
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"github.com/elastic/fleet-server/v7/internal/pkg/es"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/fleet-server/v7/internal/pkg/model"
 	"github.com/elastic/fleet-server/v7/internal/pkg/monitor"
 	"github.com/elastic/fleet-server/v7/internal/pkg/sqn"
@@ -84,7 +84,7 @@ func (d *Dispatcher) Subscribe(log zerolog.Logger, agentID string, seqNo sqn.Seq
 	sz := len(d.subs)
 	d.mx.Unlock()
 
-	log.Trace().Str(logger.AgentID, agentID).Int("sz", sz).Msg("Subscribed to action dispatcher")
+	log.Trace().Str(ecs.AgentID, agentID).Int("sz", sz).Msg("Subscribed to action dispatcher")
 
 	return &sub
 }
@@ -101,7 +101,7 @@ func (d *Dispatcher) Unsubscribe(log zerolog.Logger, sub *Sub) {
 	sz := len(d.subs)
 	d.mx.Unlock()
 
-	log.Trace().Str(logger.AgentID, sub.agentID).Int("sz", sz).Msg("Unsubscribed from action dispatcher")
+	log.Trace().Str(ecs.AgentID, sub.agentID).Int("sz", sz).Msg("Unsubscribed from action dispatcher")
 }
 
 // process gathers actions from the monitor and dispatches them to the corresponding subscriptions.
@@ -167,7 +167,7 @@ func (d *Dispatcher) getSub(agentID string) (Sub, bool) {
 func (d *Dispatcher) dispatch(ctx context.Context, agentID string, acdocs []model.Action) {
 	sub, ok := d.getSub(agentID)
 	if !ok {
-		zerolog.Ctx(ctx).Debug().Str(logger.AgentID, agentID).Msg("Agent is not currently connected. Not dispatching actions.")
+		zerolog.Ctx(ctx).Debug().Str(ecs.AgentID, agentID).Msg("Agent is not currently connected. Not dispatching actions.")
 		return
 	}
 	select {
diff --git a/internal/pkg/api/error.go b/internal/pkg/api/error.go
index 58aa8bbaee..5b859fea97 100644
--- a/internal/pkg/api/error.go
+++ b/internal/pkg/api/error.go
@@ -24,23 +24,23 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/file/uploader"
 	"github.com/elastic/fleet-server/v7/internal/pkg/limit"
 	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
-
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/hlog"
 )
 
 // Alias logger constants
 const (
-	ECSHTTPRequestID         = logger.ECSHTTPRequestID
-	ECSEventDuration         = logger.ECSEventDuration
-	ECSHTTPResponseCode      = logger.ECSHTTPResponseCode
-	ECSHTTPResponseBodyBytes = logger.ECSHTTPResponseBodyBytes
+	ECSHTTPRequestID         = ecs.HTTPRequestID
+	ECSEventDuration         = ecs.EventDuration
+	ECSHTTPResponseCode      = ecs.HTTPResponseCode
+	ECSHTTPResponseBodyBytes = ecs.HTTPResponseBodyBytes
 
-	LogAPIKeyID       = logger.APIKeyID
-	LogPolicyID       = logger.PolicyID
-	LogAgentID        = logger.AgentID
-	LogEnrollAPIKeyID = logger.EnrollAPIKeyID
-	LogAccessAPIKeyID = logger.AccessAPIKeyID
+	LogAPIKeyID       = ecs.APIKeyID
+	LogPolicyID       = ecs.PolicyID
+	LogAgentID        = ecs.AgentID
+	LogEnrollAPIKeyID = ecs.EnrollAPIKeyID
+	LogAccessAPIKeyID = ecs.AccessAPIKeyID
 )
 
 // BadRequestErr is used for request validation errors. These can be json
diff --git a/internal/pkg/api/handleAck.go b/internal/pkg/api/handleAck.go
index c0248ab9eb..fe7c327977 100644
--- a/internal/pkg/api/handleAck.go
+++ b/internal/pkg/api/handleAck.go
@@ -25,7 +25,7 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 	"github.com/elastic/fleet-server/v7/internal/pkg/dl"
 	"github.com/elastic/fleet-server/v7/internal/pkg/es"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/fleet-server/v7/internal/pkg/model"
 	"github.com/elastic/fleet-server/v7/internal/pkg/policy"
 	"github.com/elastic/fleet-server/v7/internal/pkg/smap"
@@ -243,8 +243,8 @@ func (ack *AckT) handleAckEvents(ctx context.Context, zlog zerolog.Logger, agent
 		span.Context.SetLabel("agent_id", agent.Agent.ID)
 		span.Context.SetLabel("action_id", event.ActionId)
 		log := zlog.With().
-			Str(logger.ActionID, event.ActionId).
-			Str(logger.AgentID, event.AgentId).
+			Str(ecs.ActionID, event.ActionId).
+			Str(ecs.AgentID, event.AgentId).
 			Time("timestamp", event.Timestamp).
 			Int("n", n).Logger()
 		log.Info().Msg("ack event")
@@ -365,14 +365,14 @@ func (ack *AckT) handleActionResult(ctx context.Context, zlog zerolog.Logger, ag
 
 	// Save action result document
 	if err := dl.CreateActionResult(ctx, ack.bulk, acr); err != nil {
-		zlog.Error().Err(err).Str(logger.AgentID, agent.Agent.ID).Str(logger.ActionID, action.Id).Msg("create action result")
+		zlog.Error().Err(err).Str(ecs.AgentID, agent.Agent.ID).Str(ecs.ActionID, action.Id).Msg("create action result")
 		return err
 	}
 
 	if action.Type == TypeUpgrade {
 		event, _ := ev.AsUpgradeEvent()
 		if err := ack.handleUpgrade(ctx, zlog, agent, event); err != nil {
-			zlog.Error().Err(err).Str(logger.AgentID, agent.Agent.ID).Str(logger.ActionID, action.Id).Msg("handle upgrade event")
+			zlog.Error().Err(err).Str(ecs.AgentID, agent.Agent.ID).Str(ecs.ActionID, action.Id).Msg("handle upgrade event")
 			return err
 		}
 	}
@@ -397,7 +397,7 @@ func (ack *AckT) handlePolicyChange(ctx context.Context, zlog zerolog.Logger, ag
 			Str("agent.policyId", agent.PolicyID).
 			Int64("agent.revisionIdx", currRev).
 			Str("rev.policyId", rev.PolicyID).
-			Int64(logger.RevisionIdx, rev.RevisionIdx).
+			Int64(ecs.RevisionIdx, rev.RevisionIdx).
 			Msg("ack policy revision")
 
 		if ok && rev.PolicyID == agent.PolicyID && rev.RevisionIdx > currRev {
@@ -446,7 +446,7 @@ func (ack *AckT) updateAPIKey(ctx context.Context,
 	if outputName != "" {
 		outputBulk := ack.bulk.GetBulker(outputName)
 		if outputBulk != nil {
-			zlog.Debug().Str(logger.PolicyOutputName, outputName).Msg("Using output bulker in updateAPIKey")
+			zlog.Debug().Str(ecs.PolicyOutputName, outputName).Msg("Using output bulker in updateAPIKey")
 			bulk = outputBulk
 		}
 	}
@@ -457,14 +457,14 @@ func (ack *AckT) updateAPIKey(ctx context.Context,
 				zlog.Warn().
 					Err(err).
 					Str(LogAPIKeyID, apiKeyID).
-					Str(logger.PolicyOutputName, outputName).
+					Str(ecs.PolicyOutputName, outputName).
 					Msg("Failed to read API Key roles")
 			} else {
 				// race when API key was invalidated before acking
 				zlog.Info().
 					Err(err).
 					Str(LogAPIKeyID, apiKeyID).
-					Str(logger.PolicyOutputName, outputName).
+					Str(ecs.PolicyOutputName, outputName).
 					Msg("Failed to read invalidated API Key roles")
 
 				// prevents future checks
@@ -480,14 +480,14 @@ func (ack *AckT) updateAPIKey(ctx context.Context,
 					Msg("Failed to cleanup roles")
 			} else if removedRolesCount > 0 {
 				if err := bulk.APIKeyUpdate(ctx, apiKeyID, permissionHash, clean); err != nil {
-					zlog.Error().Err(err).RawJSON("roles", clean).Str(LogAPIKeyID, apiKeyID).Str(logger.PolicyOutputName, outputName).Msg("Failed to update API Key")
+					zlog.Error().Err(err).RawJSON("roles", clean).Str(LogAPIKeyID, apiKeyID).Str(ecs.PolicyOutputName, outputName).Msg("Failed to update API Key")
 				} else {
 					zlog.Debug().
 						Str("hash.sha256", permissionHash).
 						Str(LogAPIKeyID, apiKeyID).
 						RawJSON("roles", clean).
 						Int("removedRoles", removedRolesCount).
-						Str(logger.PolicyOutputName, outputName).
+						Str(ecs.PolicyOutputName, outputName).
 						Msg("Updating agent record to pick up reduced roles.")
 				}
 			}
@@ -637,8 +637,8 @@ func (ack *AckT) handleUpgrade(ctx context.Context, zlog zerolog.Logger, agent *
 	zlog.Info().
 		Str("lastReportedVersion", agent.Agent.Version).
 		Str("upgradedAt", now).
-		Str(logger.AgentID, agent.Agent.ID).
-		Str(logger.ActionID, event.ActionId).
+		Str(ecs.AgentID, agent.Agent.ID).
+		Str(ecs.ActionID, event.ActionId).
 		Msg("ack upgrade")
 
 	return nil
@@ -719,17 +719,17 @@ func invalidateAPIKeys(ctx context.Context, zlog zerolog.Logger, bulk bulk.Bulk,
 			// read output config from .fleet-policies, not filtering by policy id as agent could be reassigned
 			policy, err := dl.QueryOutputFromPolicy(ctx, bulk, outputName)
 			if err != nil || policy == nil {
-				zlog.Warn().Str(logger.PolicyOutputName, outputName).Any("ids", outputIds).Msg("Output policy not found, API keys will be orphaned")
+				zlog.Warn().Str(ecs.PolicyOutputName, outputName).Any("ids", outputIds).Msg("Output policy not found, API keys will be orphaned")
 			} else {
 				outputBulk, _, err = bulk.CreateAndGetBulker(ctx, zlog, outputName, policy.Data.Outputs)
 				if err != nil {
-					zlog.Warn().Str(logger.PolicyOutputName, outputName).Any("ids", outputIds).Msg("Failed to recreate output bulker, API keys will be orphaned")
+					zlog.Warn().Str(ecs.PolicyOutputName, outputName).Any("ids", outputIds).Msg("Failed to recreate output bulker, API keys will be orphaned")
 				}
 			}
 		}
 		if outputBulk != nil {
 			if err := outputBulk.APIKeyInvalidate(ctx, outputIds...); err != nil {
-				zlog.Info().Err(err).Strs("ids", outputIds).Str(logger.PolicyOutputName, outputName).Msg("Failed to invalidate API keys")
+				zlog.Info().Err(err).Strs("ids", outputIds).Str(ecs.PolicyOutputName, outputName).Msg("Failed to invalidate API keys")
 			}
 		}
 	}
diff --git a/internal/pkg/api/handleCheckin.go b/internal/pkg/api/handleCheckin.go
index f1ad11dade..98f3e129f2 100644
--- a/internal/pkg/api/handleCheckin.go
+++ b/internal/pkg/api/handleCheckin.go
@@ -26,7 +26,7 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/checkin"
 	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 	"github.com/elastic/fleet-server/v7/internal/pkg/dl"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/fleet-server/v7/internal/pkg/model"
 	"github.com/elastic/fleet-server/v7/internal/pkg/monitor"
 	"github.com/elastic/fleet-server/v7/internal/pkg/policy"
@@ -260,7 +260,7 @@ func (ct *CheckinT) validateRequest(zlog zerolog.Logger, w http.ResponseWriter,
 
 func (ct *CheckinT) ProcessRequest(zlog zerolog.Logger, w http.ResponseWriter, r *http.Request, start time.Time, agent *model.Agent, ver string) error {
 	zlog = zlog.With().
-		Str(logger.AgentID, agent.Id).Logger()
+		Str(ecs.AgentID, agent.Id).Logger()
 	validated, err := ct.validateRequest(zlog, w, r, start, agent)
 	if err != nil {
 		return err
@@ -301,7 +301,7 @@ func (ct *CheckinT) ProcessRequest(zlog zerolog.Logger, w http.ResponseWriter, r
 	defer func() {
 		err := ct.pm.Unsubscribe(sub)
 		if err != nil {
-			zlog.Error().Err(err).Str(logger.PolicyID, agent.PolicyID).Msg("unable to unsubscribe from policy")
+			zlog.Error().Err(err).Str(ecs.PolicyID, agent.PolicyID).Msg("unable to unsubscribe from policy")
 		}
 	}()
 
@@ -329,7 +329,7 @@ func (ct *CheckinT) ProcessRequest(zlog zerolog.Logger, w http.ResponseWriter, r
 	// 8.16.x releases would incorrectly set unenrolled_at
 	err = ct.bc.CheckIn(agent.Id, string(req.Status), req.Message, rawMeta, rawComponents, seqno, ver, unhealthyReason, agent.AuditUnenrolledReason != "" || agent.UnenrolledAt != "")
 	if err != nil {
-		zlog.Error().Err(err).Str(logger.AgentID, agent.Id).Msg("checkin failed")
+		zlog.Error().Err(err).Str(ecs.AgentID, agent.Id).Msg("checkin failed")
 	}
 
 	// Initial fetch for pending actions
@@ -384,7 +384,7 @@ func (ct *CheckinT) ProcessRequest(zlog zerolog.Logger, w http.ResponseWriter, r
 			case <-tick.C:
 				err := ct.bc.CheckIn(agent.Id, string(req.Status), req.Message, nil, rawComponents, nil, ver, unhealthyReason, false)
 				if err != nil {
-					zlog.Error().Err(err).Str(logger.AgentID, agent.Id).Msg("checkin failed")
+					zlog.Error().Err(err).Str(ecs.AgentID, agent.Id).Msg("checkin failed")
 				}
 			}
 		}
@@ -590,8 +590,8 @@ func (ct *CheckinT) writeResponse(zlog zerolog.Logger, w http.ResponseWriter, r
 		zlog.Info().
 			Str("ackToken", fromPtr(resp.AckToken)).
 			Str("createdAt", action.CreatedAt).
-			Str(logger.ActionID, action.Id).
-			Str(logger.ActionType, string(action.Type)).
+			Str(ecs.ActionID, action.Id).
+			Str(ecs.ActionType, string(action.Type)).
 			Str("inputType", action.InputType).
 			Int64("timeout", fromPtr(action.Timeout)).
 			Msg("Action delivered to agent on checkin")
@@ -698,7 +698,7 @@ func filterActions(zlog zerolog.Logger, agentID string, actions []model.Action)
 	resp := make([]model.Action, 0, len(actions))
 	for _, action := range actions {
 		if valid := validActionTypes[action.Type]; !valid {
-			zlog.Info().Str(logger.AgentID, agentID).Str(logger.ActionID, action.ActionID).Str(logger.ActionType, action.Type).Msg("Removing action found in index from check in response")
+			zlog.Info().Str(ecs.AgentID, agentID).Str(ecs.ActionID, action.ActionID).Str(ecs.ActionType, action.Type).Msg("Removing action found in index from check in response")
 			continue
 		}
 		resp = append(resp, action)
@@ -799,7 +799,7 @@ func convertActions(zlog zerolog.Logger, agentID string, actions []model.Action)
 	for _, action := range actions {
 		ad, err := convertActionData(ActionType(action.Type), action.Data)
 		if err != nil {
-			zlog.Error().Err(err).Str(logger.ActionID, action.ActionID).Str(logger.ActionType, action.Type).Msg("Failed to convert action.Data")
+			zlog.Error().Err(err).Str(ecs.ActionID, action.ActionID).Str(ecs.ActionType, action.Type).Msg("Failed to convert action.Data")
 			continue
 		}
 		r := Action{
@@ -850,7 +850,7 @@ func processPolicy(ctx context.Context, zlog zerolog.Logger, bulker bulk.Bulk, a
 	defer span.End()
 	zlog = zlog.With().
 		Str("fleet.ctx", "processPolicy").
-		Int64(logger.RevisionIdx, pp.Policy.RevisionIdx).
+		Int64(ecs.RevisionIdx, pp.Policy.RevisionIdx).
 		Str(LogPolicyID, pp.Policy.PolicyID).
 		Logger()
 
diff --git a/internal/pkg/api/metrics.go b/internal/pkg/api/metrics.go
index 5e02adfe24..d8fc091ce4 100644
--- a/internal/pkg/api/metrics.go
+++ b/internal/pkg/api/metrics.go
@@ -25,7 +25,7 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 	"github.com/elastic/fleet-server/v7/internal/pkg/dl"
 	"github.com/elastic/fleet-server/v7/internal/pkg/limit"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/zap"
 	"github.com/elastic/fleet-server/v7/version"
 )
 
@@ -74,7 +74,7 @@ func init() {
 	cntGetPGP.Register(routesRegistry.newRegistry("getPGPKey"))
 	cntAuditUnenroll.Register(routesRegistry.newRegistry("auditUnenroll"))
 
-	err := report.SetupMetrics(logger.NewZapStub("instance-metrics"), build.ServiceName, version.DefaultVersion, monitoring.NewRegistry(), registry.registry)
+	err := report.SetupMetrics(zap.NewStub("instance-metrics"), build.ServiceName, version.DefaultVersion, monitoring.NewRegistry(), registry.registry)
 	if err != nil {
 		zerolog.Ctx(context.TODO()).Error().Err(err).Msg("unable to initialize metrics") // TODO is used because this may logged during the package load
 	}
@@ -256,7 +256,7 @@ func InitMetrics(ctx context.Context, cfg *config.Config, bi build.Info, tracer
 	}
 
 	// Start local api server; largely for metrics.
-	zapStub := logger.NewZapStub("fleet-metrics")
+	zapStub := zap.NewStub("fleet-metrics")
 	cfgStub, err := cfglib.NewConfigFrom(&cfg.HTTP)
 	if err != nil {
 		return nil, err
diff --git a/internal/pkg/api/server.go b/internal/pkg/api/server.go
index 8e9b895b91..e33259ff1a 100644
--- a/internal/pkg/api/server.go
+++ b/internal/pkg/api/server.go
@@ -13,10 +13,12 @@ import (
 	"net"
 	"net/http"
 
+	"github.com/elastic/elastic-agent-libs/logp"
 	"github.com/elastic/elastic-agent-libs/transport/tlscommon"
-	"github.com/elastic/fleet-server/v7/internal/pkg/config"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
 
+	"github.com/elastic/fleet-server/v7/internal/pkg/config"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/zap"
 	"github.com/rs/zerolog"
 )
 
@@ -24,6 +26,7 @@ type server struct {
 	cfg     *config.Server
 	addr    string
 	handler http.Handler
+	logger  *logp.Logger
 }
 
 // NewServer creates a new HTTP api for the passed addr.
@@ -39,6 +42,7 @@ func NewServer(addr string, cfg *config.Server, opts ...APIOpt) *server {
 		addr:    addr,
 		cfg:     cfg,
 		handler: newRouter(&cfg.Limits, a, a.tracer),
+		logger:  zap.NewStub("api-server"),
 	}
 }
 
@@ -76,7 +80,7 @@ func (s *server) Run(ctx context.Context) error {
 	}()
 
 	if s.cfg.TLS != nil && s.cfg.TLS.IsEnabled() {
-		commonTLSCfg, err := tlscommon.LoadTLSServerConfig(s.cfg.TLS)
+		commonTLSCfg, err := tlscommon.LoadTLSServerConfig(s.cfg.TLS, s.logger)
 		if err != nil {
 			return err
 		}
@@ -148,7 +152,7 @@ type stubLogger struct {
 }
 
 func (s *stubLogger) Write(p []byte) (n int, err error) {
-	s.log.Error().Bytes(logger.ECSMessage, p).Send()
+	s.log.Error().Bytes(ecs.Message, p).Send()
 	return len(p), nil
 }
 
diff --git a/internal/pkg/bulk/engine.go b/internal/pkg/bulk/engine.go
index 1cdc3653ff..c999ffe453 100644
--- a/internal/pkg/bulk/engine.go
+++ b/internal/pkg/bulk/engine.go
@@ -18,7 +18,7 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/build"
 	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 	"github.com/elastic/fleet-server/v7/internal/pkg/es"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/go-ucfg"
 
 	"github.com/rs/zerolog"
@@ -192,7 +192,7 @@ func (b *Bulker) CreateAndGetBulker(ctx context.Context, zlog zerolog.Logger, ou
 	errCh := make(chan error)
 	go func() {
 		runFunc := func() (err error) {
-			zlog.Debug().Str(logger.PolicyOutputName, outputName).Msg("Bulker started")
+			zlog.Debug().Str(ecs.PolicyOutputName, outputName).Msg("Bulker started")
 			return newBulker.Run(bulkCtx)
 		}
 
@@ -201,9 +201,9 @@ func (b *Bulker) CreateAndGetBulker(ctx context.Context, zlog zerolog.Logger, ou
 	go func() {
 		select {
 		case err = <-errCh:
-			zlog.Error().Err(err).Str(logger.PolicyOutputName, outputName).Msg("Bulker error")
+			zlog.Error().Err(err).Str(ecs.PolicyOutputName, outputName).Msg("Bulker error")
 		case <-bulkCtx.Done():
-			zlog.Debug().Str(logger.PolicyOutputName, outputName).Msg("Bulk context done")
+			zlog.Debug().Str(ecs.PolicyOutputName, outputName).Msg("Bulk context done")
 			err = bulkCtx.Err()
 		}
 	}()
diff --git a/internal/pkg/config/output.go b/internal/pkg/config/output.go
index b1562f7ef0..99726904bb 100644
--- a/internal/pkg/config/output.go
+++ b/internal/pkg/config/output.go
@@ -20,6 +20,8 @@ import (
 	urlutil "github.com/elastic/elastic-agent-libs/kibana"
 	"github.com/elastic/elastic-agent-libs/transport/httpcommon"
 	"github.com/elastic/elastic-agent-libs/transport/tlscommon"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/zap"
+
 	"github.com/elastic/go-elasticsearch/v8"
 	"github.com/rs/zerolog"
 )
@@ -73,7 +75,7 @@ func (c *Elasticsearch) Validate() error {
 		}
 	}
 	if c.TLS != nil && c.TLS.IsEnabled() {
-		_, err := tlscommon.LoadTLSConfig(c.TLS)
+		_, err := tlscommon.LoadTLSConfig(c.TLS, zap.NewStub("elasticsearch-output"))
 		if err != nil {
 			return err
 		}
@@ -121,7 +123,7 @@ func (c *Elasticsearch) ToESConfig(longPoll bool) (elasticsearch.Config, error)
 	}
 
 	if c.TLS != nil && c.TLS.IsEnabled() {
-		tls, err := tlscommon.LoadTLSConfig(c.TLS)
+		tls, err := tlscommon.LoadTLSConfig(c.TLS, zap.NewStub("elasticsearch-output"))
 		if err != nil {
 			return elasticsearch.Config{}, err
 		}
diff --git a/internal/pkg/dl/policies.go b/internal/pkg/dl/policies.go
index 9de7cf4171..0bbaf7d57f 100644
--- a/internal/pkg/dl/policies.go
+++ b/internal/pkg/dl/policies.go
@@ -12,11 +12,10 @@ import (
 	"github.com/rs/zerolog"
 
 	"github.com/elastic/fleet-server/v7/internal/pkg/bulk"
+	"github.com/elastic/fleet-server/v7/internal/pkg/dsl"
 	"github.com/elastic/fleet-server/v7/internal/pkg/es"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/fleet-server/v7/internal/pkg/model"
-
-	"github.com/elastic/fleet-server/v7/internal/pkg/dsl"
 )
 
 var (
@@ -111,6 +110,6 @@ func QueryOutputFromPolicy(ctx context.Context, bulker bulk.Bulk, outputName str
 			return &policy, nil
 		}
 	}
-	zerolog.Ctx(ctx).Debug().Str(logger.PolicyOutputName, outputName).Msg("policy with output not found")
+	zerolog.Ctx(ctx).Debug().Str(ecs.PolicyOutputName, outputName).Msg("policy with output not found")
 	return nil, nil
 }
diff --git a/internal/pkg/logger/ecs.go b/internal/pkg/logger/ecs.go
deleted file mode 100644
index 9dd44cb7fe..0000000000
--- a/internal/pkg/logger/ecs.go
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
-// or more contributor license agreements. Licensed under the Elastic License;
-// you may not use this file except in compliance with the Elastic License.
-
-package logger
-
-const (
-
-	// Basic logging
-	ECSLogLevel      = "log.level"
-	ECSLogName       = "log.logger"
-	ECSLogCaller     = "log.origin"
-	ECSLogStackTrace = "log.origin.stack_trace"
-	ECSMessage       = "message"
-	ECSTimestamp     = "@timestamp"
-	ECSErrorMessage  = "error.message"
-
-	// HTTP
-	ECSHTTPVersion           = "http.version"
-	ECSHTTPRequestID         = "http.request.id"
-	ECSHTTPRequestMethod     = "http.request.method"
-	ECSHTTPRequestBodyBytes  = "http.request.body.bytes"
-	ECSHTTPResponseCode      = "http.response.status_code"
-	ECSHTTPResponseBodyBytes = "http.response.body.bytes"
-
-	// URL
-	ECSURLFull   = "url.full"
-	ECSURLDomain = "url.domain"
-	ECSURLPort   = "url.port"
-
-	// Client
-	ECSClientAddress = "client.address"
-	ECSClientIP      = "client.ip"
-	ECSClientPort    = "client.port"
-
-	// Server
-	ECSServerAddress = "server.address"
-
-	// TLS
-	ECSTLSEstablished        = "tls.established"
-	ECSTLSsResumed           = "tls.resumed"
-	ECSTLSVersion            = "tls.version"
-	ECSTLSClientServerName   = "tls.client.server_name"
-	ECSTLSCipher             = "tls.cipher"
-	ECSTLSClientIssuer       = "tls.client.issuer"
-	ECSTLSClientSubject      = "tls.client.subject"
-	ECSTLSClientNotBefore    = "tls.client.not_before"
-	ECSTLSClientNotAfter     = "tls.client.not_after"
-	ECSTLSClientSerialNumber = "tls.client.x509.serial_number"
-	ECSTLSClientTimeFormat   = "2006-01-02T15:04:05.999Z"
-
-	// Event
-	ECSEventDuration = "event.duration"
-
-	// Service
-	ECSServiceName = "service.name"
-	ECSServiceType = "service.type"
-)
-
-// Non ECS compliant contants used in logging
-
-const (
-	APIKeyID              = "fleet.apikey.id" //nolint:gosec // key name
-	PolicyID              = "fleet.policy.id"
-	AgentID               = "fleet.agent.id"
-	EnrollAPIKeyID        = "fleet.enroll.apikey.id"
-	AccessAPIKeyID        = "fleet.access.apikey.id"
-	DefaultOutputAPIKeyID = "fleet.default.apikey.id"
-	ActionID              = "fleet.action.id"
-	ActionType            = "fleet.action.type"
-	PolicyOutputName      = "fleet.policy.output.name"
-	RevisionIdx           = "fleet.revision_idx"
-	CoordinatorIdx        = "fleet.coordinator_idx"
-)
diff --git a/internal/pkg/logger/ecs/ecs.go b/internal/pkg/logger/ecs/ecs.go
new file mode 100644
index 0000000000..f3e658d446
--- /dev/null
+++ b/internal/pkg/logger/ecs/ecs.go
@@ -0,0 +1,74 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package ecs
+
+const (
+
+	// Basic logging
+	LogLevel      = "log.level"
+	LogName       = "log.logger"
+	LogCaller     = "log.origin"
+	LogStackTrace = "log.origin.stack_trace"
+	Message       = "message"
+	Timestamp     = "@timestamp"
+	ErrorMessage  = "error.message"
+
+	// HTTP
+	HTTPVersion           = "http.version"
+	HTTPRequestID         = "http.request.id"
+	HTTPRequestMethod     = "http.request.method"
+	HTTPRequestBodyBytes  = "http.request.body.bytes"
+	HTTPResponseCode      = "http.response.status_code"
+	HTTPResponseBodyBytes = "http.response.body.bytes"
+
+	// URL
+	URLFull   = "url.full"
+	URLDomain = "url.domain"
+	URLPort   = "url.port"
+
+	// Client
+	ClientAddress = "client.address"
+	ClientIP      = "client.ip"
+	ClientPort    = "client.port"
+
+	// Server
+	ServerAddress = "server.address"
+
+	// TLS
+	TLSEstablished        = "tls.established"
+	TLSResumed            = "tls.resumed"
+	TLSVersion            = "tls.version"
+	TLSClientServerName   = "tls.client.server_name"
+	TLSCipher             = "tls.cipher"
+	TLSClientIssuer       = "tls.client.issuer"
+	TLSClientSubject      = "tls.client.subject"
+	TLSClientNotBefore    = "tls.client.not_before"
+	TLSClientNotAfter     = "tls.client.not_after"
+	TLSClientSerialNumber = "tls.client.x509.serial_number"
+	TLSClientTimeFormat   = "2006-01-02T15:04:05.999Z"
+
+	// Event
+	EventDuration = "event.duration"
+
+	// Service
+	ServiceName = "service.name"
+	ServiceType = "service.type"
+)
+
+// Non ECS compliant contants used in logging
+
+const (
+	APIKeyID              = "fleet.apikey.id" //nolint:gosec // key name
+	PolicyID              = "fleet.policy.id"
+	AgentID               = "fleet.agent.id"
+	EnrollAPIKeyID        = "fleet.enroll.apikey.id"
+	AccessAPIKeyID        = "fleet.access.apikey.id"
+	DefaultOutputAPIKeyID = "fleet.default.apikey.id"
+	ActionID              = "fleet.action.id"
+	ActionType            = "fleet.action.type"
+	PolicyOutputName      = "fleet.policy.output.name"
+	RevisionIdx           = "fleet.revision_idx"
+	CoordinatorIdx        = "fleet.coordinator_idx"
+)
diff --git a/internal/pkg/logger/http.go b/internal/pkg/logger/http.go
index 62ae923e93..118825cf77 100644
--- a/internal/pkg/logger/http.go
+++ b/internal/pkg/logger/http.go
@@ -22,6 +22,7 @@ import (
 	"go.elastic.co/apm/module/apmzerolog/v2"
 
 	"github.com/elastic/fleet-server/v7/internal/pkg/apikey"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 )
 
 const (
@@ -129,65 +130,65 @@ func stripHTTP(h string) string {
 func httpMeta(r *http.Request, e *zerolog.Event) {
 	oldForce := r.URL.ForceQuery
 	r.URL.ForceQuery = false
-	e.Str(ECSURLFull, r.URL.String())
+	e.Str(ecs.URLFull, r.URL.String())
 	r.URL.ForceQuery = oldForce
 
 	if domain := r.URL.Hostname(); domain != "" {
-		e.Str(ECSURLDomain, domain)
+		e.Str(ecs.URLDomain, domain)
 	}
 
 	port := r.URL.Port()
 	if port != "" {
 		if v, err := strconv.Atoi(port); err == nil {
-			e.Int(ECSURLPort, v)
+			e.Int(ecs.URLPort, v)
 		}
 	}
 
 	// HTTP info
-	e.Str(ECSHTTPVersion, stripHTTP(r.Proto))
-	e.Str(ECSHTTPRequestMethod, r.Method)
+	e.Str(ecs.HTTPVersion, stripHTTP(r.Proto))
+	e.Str(ecs.HTTPRequestMethod, r.Method)
 
 	// ApiKey
 	if apiKey, err := apikey.ExtractAPIKey(r); err == nil {
-		e.Str(APIKeyID, apiKey.ID)
+		e.Str(ecs.APIKeyID, apiKey.ID)
 	}
 
 	// Client info
 	if r.RemoteAddr != "" {
-		e.Str(ECSClientAddress, r.RemoteAddr)
+		e.Str(ecs.ClientAddress, r.RemoteAddr)
 	}
 
 	// TLS info
-	e.Bool(ECSTLSEstablished, r.TLS != nil)
+	e.Bool(ecs.TLSEstablished, r.TLS != nil)
 }
 
 func httpDebug(r *http.Request, e *zerolog.Event) {
 	// Client info
 	if r.RemoteAddr != "" {
 		remoteIP, remotePort := splitAddr(r.RemoteAddr)
-		e.Str(ECSClientIP, remoteIP)
-		e.Int(ECSClientPort, remotePort)
+		e.Str(ecs.ClientIP, remoteIP)
+		e.Int(ecs.ClientPort, remotePort)
 	}
 
 	if r.TLS != nil {
 
-		e.Str(ECSTLSVersion, TLSVersionToString(r.TLS.Version))
-		e.Str(ECSTLSCipher, tls.CipherSuiteName(r.TLS.CipherSuite))
-		e.Bool(ECSTLSsResumed, r.TLS.DidResume)
+		e.Str(ecs.TLSVersion, TLSVersionToString(r.TLS.Version))
+		e.Str(ecs.TLSCipher, tls.CipherSuiteName(r.TLS.CipherSuite))
+		e.Bool(ecs.TLSResumed, r.TLS.DidResume)
 
 		if r.TLS.ServerName != "" {
-			e.Str(ECSTLSClientServerName, r.TLS.ServerName)
+			e.Str(ecs.TLSClientServerName, r.TLS.ServerName)
 		}
 
 		if len(r.TLS.PeerCertificates) > 0 && r.TLS.PeerCertificates[0] != nil {
 			leaf := r.TLS.PeerCertificates[0]
 			if leaf.SerialNumber != nil {
-				e.Str(ECSTLSClientSerialNumber, leaf.SerialNumber.String())
+				e.Str(ecs.TLSClientSerialNumber, leaf.SerialNumber.String())
 			}
-			e.Str(ECSTLSClientIssuer, leaf.Issuer.String())
-			e.Str(ECSTLSClientSubject, leaf.Subject.String())
-			e.Str(ECSTLSClientNotBefore, leaf.NotBefore.UTC().Format(ECSTLSClientTimeFormat))
-			e.Str(ECSTLSClientNotAfter, leaf.NotAfter.UTC().Format(ECSTLSClientTimeFormat))
+			e.Str(ecs.TLSClientIssuer, leaf.Issuer.String())
+			e.Str(ecs.TLSClientSubject, leaf.Subject.String())
+			e.Str(ecs.TLSClientNotBefore, leaf.NotBefore.UTC().Format(ecs.TLSClientTimeFormat))
+			e.Str(ecs.TLSClientNotAfter, leaf.NotAfter.UTC().Format(ecs.TLSClientTimeFormat))
 		}
 	}
 }
@@ -227,7 +228,7 @@ func Middleware(next http.Handler) http.Handler {
 		zlog := zerolog.Ctx(ctx).Hook(apmzerolog.TraceContextHook(ctx))
 		// Update request context
 		// NOTE this injects the request id and addr into all logs that use the request logger
-		zlog = zlog.With().Str(ECSHTTPRequestID, reqID).Str(ECSServerAddress, addr).Logger()
+		zlog = zlog.With().Str(ecs.HTTPRequestID, reqID).Str(ecs.ServerAddress, addr).Logger()
 		ctx = zlog.WithContext(ctx)
 		ctx = context.WithValue(ctx, ctxTSKey{}, start)
 		r = r.WithContext(ctx)
@@ -256,10 +257,10 @@ func Middleware(next http.Handler) http.Handler {
 
 		// Write an info level log line for each HTTP request if debug is enabled, or a non-2XX status is returned.
 		if zlog.Debug().Enabled() || (wrCounter.statusCode < 200 || wrCounter.statusCode >= 300) {
-			e.Uint64(ECSHTTPRequestBodyBytes, rdCounter.Count())
-			e.Uint64(ECSHTTPResponseBodyBytes, wrCounter.Count())
-			e.Int(ECSHTTPResponseCode, wrCounter.statusCode)
-			e.Int64(ECSEventDuration, time.Since(start).Nanoseconds())
+			e.Uint64(ecs.HTTPRequestBodyBytes, rdCounter.Count())
+			e.Uint64(ecs.HTTPResponseBodyBytes, wrCounter.Count())
+			e.Int(ecs.HTTPResponseCode, wrCounter.statusCode)
+			e.Int64(ecs.EventDuration, time.Since(start).Nanoseconds())
 			e.Msg("HTTP Request")
 		}
 	}
diff --git a/internal/pkg/logger/http_test.go b/internal/pkg/logger/http_test.go
index 1f2ede0c81..b634c3e637 100644
--- a/internal/pkg/logger/http_test.go
+++ b/internal/pkg/logger/http_test.go
@@ -14,6 +14,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
+
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/require"
 )
@@ -53,7 +55,7 @@ func TestMiddleware(t *testing.T) {
 	var obj map[string]any
 	err = json.Unmarshal(b.Bytes(), &obj)
 	require.NoError(t, err)
-	v, ok := obj[ECSServerAddress]
-	require.Truef(t, ok, "expected to find key: %s in %v", ECSServerAddress, obj)
+	v, ok := obj[ecs.ServerAddress]
+	require.Truef(t, ok, "expected to find key: %s in %v", ecs.ServerAddress, obj)
 	require.NotEmpty(t, v)
 }
diff --git a/internal/pkg/logger/logger.go b/internal/pkg/logger/logger.go
index b6da6de917..5994d22397 100644
--- a/internal/pkg/logger/logger.go
+++ b/internal/pkg/logger/logger.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/elastic/elastic-agent-libs/file"
 	"github.com/elastic/fleet-server/v7/internal/pkg/config"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 )
 
 var once sync.Once
@@ -85,7 +86,7 @@ func Init(cfg *config.Config, svcName string) (*Logger, error) {
 		}
 		l := ecszerolog.New(out)
 		if svcName != "" {
-			l = l.With().Str(ECSServiceName, svcName).Str(ECSServiceType, svcName).Logger()
+			l = l.With().Str(ecs.ServiceName, svcName).Str(ecs.ServiceType, svcName).Logger()
 		}
 
 		log.Logger = l
diff --git a/internal/pkg/logger/logger_test.go b/internal/pkg/logger/logger_test.go
index fcb0c2abc7..1d03ab8523 100644
--- a/internal/pkg/logger/logger_test.go
+++ b/internal/pkg/logger/logger_test.go
@@ -10,11 +10,12 @@ import (
 	"context"
 	"testing"
 
-	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 )
 
 func stderrcfg() *config.Config {
diff --git a/internal/pkg/logger/zapStub.go b/internal/pkg/logger/zap/zapStub.go
similarity index 84%
rename from internal/pkg/logger/zapStub.go
rename to internal/pkg/logger/zap/zapStub.go
index 5874ca9b86..56fa3faad4 100644
--- a/internal/pkg/logger/zapStub.go
+++ b/internal/pkg/logger/zap/zapStub.go
@@ -2,7 +2,7 @@
 // or more contributor license agreements. Licensed under the Elastic License;
 // you may not use this file except in compliance with the Elastic License.
 
-package logger
+package zap
 
 import (
 	"encoding/json"
@@ -13,16 +13,17 @@ import (
 	"go.uber.org/zap/zapcore"
 
 	"github.com/elastic/elastic-agent-libs/logp"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 )
 
 func encoderConfig() zapcore.EncoderConfig {
 	return zapcore.EncoderConfig{
-		MessageKey:     ECSMessage,
-		LevelKey:       ECSLogLevel,
-		NameKey:        ECSLogName,
-		TimeKey:        ECSTimestamp,
-		CallerKey:      ECSLogCaller,
-		StacktraceKey:  ECSLogStackTrace,
+		MessageKey:     ecs.Message,
+		LevelKey:       ecs.LogLevel,
+		NameKey:        ecs.LogName,
+		TimeKey:        ecs.Timestamp,
+		CallerKey:      ecs.LogCaller,
+		StacktraceKey:  ecs.LogStackTrace,
 		LineEnding:     "\n",
 		EncodeTime:     zapcore.EpochTimeEncoder,
 		EncodeLevel:    zapcore.LowercaseLevelEncoder,
@@ -70,7 +71,7 @@ func (z zapStub) Write(p []byte) (n int, err error) {
 	for key, val := range m {
 
 		// Don't dupe the timestamp, use the fleet formatted timestamp.
-		if key != ECSTimestamp {
+		if key != ecs.Timestamp {
 			e.Interface(key, val)
 		}
 	}
@@ -79,7 +80,7 @@ func (z zapStub) Write(p []byte) (n int, err error) {
 	return 0, nil
 }
 
-func NewZapStub(selector string) *logp.Logger {
+func NewStub(selector string) *logp.Logger {
 
 	wrapF := func(zapcore.Core) zapcore.Core {
 		enc := zapcore.NewJSONEncoder(encoderConfig())
diff --git a/internal/pkg/policy/monitor.go b/internal/pkg/policy/monitor.go
index 4616003b2d..55563b902b 100644
--- a/internal/pkg/policy/monitor.go
+++ b/internal/pkg/policy/monitor.go
@@ -18,7 +18,7 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 	"github.com/elastic/fleet-server/v7/internal/pkg/dl"
 	"github.com/elastic/fleet-server/v7/internal/pkg/es"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/fleet-server/v7/internal/pkg/model"
 	"github.com/elastic/fleet-server/v7/internal/pkg/monitor"
 )
@@ -291,7 +291,7 @@ func (m *monitorT) dispatchPending(ctx context.Context) {
 		policy, ok := m.policies[s.policyID]
 		if !ok {
 			m.log.Warn().
-				Str(logger.PolicyID, s.policyID).
+				Str(ecs.PolicyID, s.policyID).
 				Msg("logic error: policy missing on dispatch")
 			return
 		}
@@ -303,16 +303,16 @@ func (m *monitorT) dispatchPending(ctx context.Context) {
 			return
 		case s.ch <- &policy.pp:
 			m.log.Debug().
-				Str(logger.PolicyID, s.policyID).
+				Str(ecs.PolicyID, s.policyID).
 				Int64("subscription_revision_idx", s.revIdx).
-				Int64(logger.RevisionIdx, s.revIdx).
+				Int64(ecs.RevisionIdx, s.revIdx).
 				Msg("dispatch policy change")
 		default:
 			// Should never block on a channel; we created a channel of size one.
 			// A block here indicates a logic error somewheres.
 			m.log.Error().
-				Str(logger.PolicyID, s.policyID).
-				Str(logger.AgentID, s.agentID).
+				Str(ecs.PolicyID, s.policyID).
+				Str(ecs.AgentID, s.agentID).
 				Msg("logic error: should never block on policy channel")
 			return
 		}
@@ -363,8 +363,8 @@ func (m *monitorT) processPolicies(ctx context.Context, policies []model.Policy)
 		return nil
 	}
 
-	m.log.Debug().Int64(logger.RevisionIdx, policies[0].RevisionIdx).
-		Str(logger.PolicyID, policies[0].PolicyID).Msg("process policies")
+	m.log.Debug().Int64(ecs.RevisionIdx, policies[0].RevisionIdx).
+		Str(ecs.PolicyID, policies[0].PolicyID).Msg("process policies")
 
 	latest := m.groupByLatest(policies)
 	for _, policy := range latest {
@@ -401,13 +401,13 @@ func (m *monitorT) updatePolicy(ctx context.Context, pp *ParsedPolicy) bool {
 	newPolicy := pp.Policy
 
 	span, _ := apm.StartSpan(ctx, "update policy", "process")
-	span.Context.SetLabel(logger.PolicyID, newPolicy.PolicyID)
+	span.Context.SetLabel(ecs.PolicyID, newPolicy.PolicyID)
 	span.Context.SetLabel(dl.FieldRevisionIdx, newPolicy.RevisionIdx)
 	defer span.End()
 
 	zlog := m.log.With().
-		Str(logger.PolicyID, newPolicy.PolicyID).
-		Int64(logger.RevisionIdx, newPolicy.RevisionIdx).
+		Str(ecs.PolicyID, newPolicy.PolicyID).
+		Int64(ecs.RevisionIdx, newPolicy.RevisionIdx).
 		Logger()
 
 	m.mut.Lock()
@@ -420,7 +420,7 @@ func (m *monitorT) updatePolicy(ctx context.Context, pp *ParsedPolicy) bool {
 			head: makeHead(),
 		}
 		m.policies[newPolicy.PolicyID] = p
-		zlog.Info().Str(logger.PolicyID, newPolicy.PolicyID).Msg("New policy found on update and added")
+		zlog.Info().Str(ecs.PolicyID, newPolicy.PolicyID).Msg("New policy found on update and added")
 		return false
 	}
 
@@ -430,7 +430,7 @@ func (m *monitorT) updatePolicy(ctx context.Context, pp *ParsedPolicy) bool {
 	// Update the policy in our data structure
 	p.pp = *pp
 	m.policies[newPolicy.PolicyID] = p
-	zlog.Debug().Str(logger.PolicyID, newPolicy.PolicyID).Msg("Update policy revision")
+	zlog.Debug().Str(ecs.PolicyID, newPolicy.PolicyID).Msg("Update policy revision")
 
 	// Iterate through the subscriptions on this policy;
 	// schedule any subscription for delivery that requires an update.
@@ -453,7 +453,7 @@ func (m *monitorT) updatePolicy(ctx context.Context, pp *ParsedPolicy) bool {
 			}
 
 			zlog.Debug().
-				Str(logger.AgentID, sub.agentID).
+				Str(ecs.AgentID, sub.agentID).
 				Msg("scheduled pendingQ on policy revision")
 
 			nQueued += 1
@@ -463,7 +463,7 @@ func (m *monitorT) updatePolicy(ctx context.Context, pp *ParsedPolicy) bool {
 	zlog.Info().
 		Int64("old_revision_idx", oldPolicy.RevisionIdx).
 		Int("nSubs", nQueued).
-		Str(logger.PolicyID, newPolicy.PolicyID).
+		Str(ecs.PolicyID, newPolicy.PolicyID).
 		Msg("New revision of policy received and added to the queue")
 
 	return true
@@ -490,9 +490,9 @@ func (m *monitorT) Subscribe(agentID string, policyID string, revisionIdx int64)
 		return nil, errors.New("revisionIdx must be greater than or equal to 0")
 	}
 	m.log.Debug().
-		Str(logger.AgentID, agentID).
-		Str(logger.PolicyID, policyID).
-		Int64(logger.RevisionIdx, revisionIdx).
+		Str(ecs.AgentID, agentID).
+		Str(ecs.PolicyID, policyID).
+		Int64(ecs.RevisionIdx, revisionIdx).
 		Msg("subscribed to policy monitor")
 
 	s := NewSub(
@@ -509,8 +509,8 @@ func (m *monitorT) Subscribe(agentID string, policyID string, revisionIdx int64)
 	case !ok:
 		// We've not seen this policy before, force load.
 		m.log.Info().
-			Str(logger.PolicyID, policyID).
-			Str(logger.AgentID, s.agentID).
+			Str(ecs.PolicyID, policyID).
+			Str(ecs.AgentID, s.agentID).
 			Msg("force load on unknown policyId")
 		p = policyT{head: makeHead()}
 		p.head.pushBack(s)
@@ -520,17 +520,17 @@ func (m *monitorT) Subscribe(agentID string, policyID string, revisionIdx int64)
 		empty := m.pendingQ.isEmpty()
 		m.pendingQ.pushBack(s)
 		m.log.Debug().
-			Str(logger.AgentID, s.agentID).
-			Int64(logger.RevisionIdx, (&p.pp.Policy).RevisionIdx).
+			Str(ecs.AgentID, s.agentID).
+			Int64(ecs.RevisionIdx, (&p.pp.Policy).RevisionIdx).
 			Msg("deploy pending on subscribe")
 		if empty {
 			m.kickDeploy()
 		}
 	default:
 		m.log.Debug().
-			Str(logger.PolicyID, policyID).
-			Str(logger.AgentID, s.agentID).
-			Int64(logger.RevisionIdx, (&p.pp.Policy).RevisionIdx).
+			Str(ecs.PolicyID, policyID).
+			Str(ecs.AgentID, s.agentID).
+			Int64(ecs.RevisionIdx, (&p.pp.Policy).RevisionIdx).
 			Msg("subscription added without new revision")
 		p.head.pushBack(s)
 	}
@@ -550,9 +550,9 @@ func (m *monitorT) Unsubscribe(sub Subscription) error {
 	m.mut.Unlock()
 
 	m.log.Debug().
-		Str(logger.AgentID, s.agentID).
-		Str(logger.PolicyID, s.policyID).
-		Int64(logger.RevisionIdx, s.revIdx).
+		Str(ecs.AgentID, s.agentID).
+		Str(ecs.PolicyID, s.policyID).
+		Int64(ecs.RevisionIdx, s.revIdx).
 		Msg("unsubscribe")
 
 	return nil
diff --git a/internal/pkg/policy/policy_output.go b/internal/pkg/policy/policy_output.go
index 1d099cd8be..ab3be604d4 100644
--- a/internal/pkg/policy/policy_output.go
+++ b/internal/pkg/policy/policy_output.go
@@ -19,7 +19,7 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/apikey"
 	"github.com/elastic/fleet-server/v7/internal/pkg/bulk"
 	"github.com/elastic/fleet-server/v7/internal/pkg/dl"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/fleet-server/v7/internal/pkg/model"
 	"github.com/elastic/fleet-server/v7/internal/pkg/smap"
 )
@@ -50,8 +50,8 @@ func (p *Output) Prepare(ctx context.Context, zlog zerolog.Logger, bulker bulk.B
 	defer span.End()
 	span.Context.SetLabel("output_type", p.Type)
 	zlog = zlog.With().
-		Str(logger.AgentID, agent.Id).
-		Str(logger.PolicyOutputName, p.Name).Logger()
+		Str(ecs.AgentID, agent.Id).
+		Str(ecs.PolicyOutputName, p.Name).Logger()
 
 	switch p.Type {
 	case OutputTypeElasticsearch:
@@ -125,7 +125,7 @@ func (p *Output) prepareElasticsearch(
 			}
 		}
 		if !found {
-			zlog.Info().Str(logger.APIKeyID, agentOutput.APIKeyID).Str(logger.PolicyOutputName, agentOutputName).Msg("Output removed, will retire API key")
+			zlog.Info().Str(ecs.APIKeyID, agentOutput.APIKeyID).Str(ecs.PolicyOutputName, agentOutputName).Msg("Output removed, will retire API key")
 			toRetireAPIKeys = &model.ToRetireAPIKeyIdsItems{
 				ID:        agentOutput.APIKeyID,
 				RetiredAt: time.Now().UTC().Format(time.RFC3339),
@@ -270,10 +270,10 @@ func (p *Output) prepareElasticsearch(
 					State:   client.UnitStateDegraded.String(),
 					Message: fmt.Sprintf("remote ES could not create API key due to error: %v", err),
 				}
-				zerolog.Ctx(ctx).Warn().Err(err).Str(logger.PolicyOutputName, p.Name).Msg(doc.Message)
+				zerolog.Ctx(ctx).Warn().Err(err).Str(ecs.PolicyOutputName, p.Name).Msg(doc.Message)
 
 				if err := dl.CreateOutputHealth(ctx, bulker, doc); err != nil {
-					zlog.Error().Err(err).Str(logger.PolicyOutputName, p.Name).Msg("error writing output health")
+					zlog.Error().Err(err).Str(ecs.PolicyOutputName, p.Name).Msg("error writing output health")
 				}
 			}
 
@@ -301,7 +301,7 @@ func (p *Output) prepareElasticsearch(
 		// are supported.
 		zlog.Info().
 			Str("fleet.policy.role.hash.sha256", p.Role.Sha2).
-			Str(logger.DefaultOutputAPIKeyID, outputAPIKey.ID).
+			Str(ecs.DefaultOutputAPIKeyID, outputAPIKey.ID).
 			Msg("Updating agent record to pick up default output key.")
 
 		fields := map[string]interface{}{
@@ -519,7 +519,7 @@ func generateOutputAPIKey(
 	outputName string,
 	roles []byte) (*apikey.APIKey, error) {
 	name := fmt.Sprintf("%s:%s", agentID, outputName)
-	zerolog.Ctx(ctx).Info().Str(logger.AgentID, agentID).Msgf("generating output API key %s",
+	zerolog.Ctx(ctx).Info().Str(ecs.AgentID, agentID).Msgf("generating output API key %s",
 		name)
 	return bulk.APIKeyCreate(
 		ctx,
diff --git a/internal/pkg/policy/self.go b/internal/pkg/policy/self.go
index 672904cc89..79df146fab 100644
--- a/internal/pkg/policy/self.go
+++ b/internal/pkg/policy/self.go
@@ -20,7 +20,7 @@ import (
 	"github.com/elastic/fleet-server/v7/internal/pkg/config"
 	"github.com/elastic/fleet-server/v7/internal/pkg/dl"
 	"github.com/elastic/fleet-server/v7/internal/pkg/es"
-	"github.com/elastic/fleet-server/v7/internal/pkg/logger"
+	"github.com/elastic/fleet-server/v7/internal/pkg/logger/ecs"
 	"github.com/elastic/fleet-server/v7/internal/pkg/model"
 	"github.com/elastic/fleet-server/v7/internal/pkg/monitor"
 	"github.com/elastic/fleet-server/v7/internal/pkg/state"
@@ -275,15 +275,15 @@ func reportOutputHealth(ctx context.Context, bulker bulk.Bulk, zlog zerolog.Logg
 		if err != nil {
 			doc.State = client.UnitStateDegraded.String()
 			doc.Message = fmt.Sprintf("remote ES is not reachable due to error: %s", err.Error())
-			zlog.Error().Err(err).Str(logger.PolicyOutputName, outputName).Msg(doc.Message)
+			zlog.Error().Err(err).Str(ecs.PolicyOutputName, outputName).Msg(doc.Message)
 
 		} else if res.StatusCode != 200 {
 			doc.State = client.UnitStateDegraded.String()
 			doc.Message = fmt.Sprintf("remote ES is not reachable due to unexpected status code %d", res.StatusCode)
-			zlog.Error().Err(err).Str(logger.PolicyOutputName, outputName).Msg(doc.Message)
+			zlog.Error().Err(err).Str(ecs.PolicyOutputName, outputName).Msg(doc.Message)
 		}
 		if err := dl.CreateOutputHealth(ctx, bulker, doc); err != nil {
-			zlog.Error().Err(err).Str(logger.PolicyOutputName, outputName).Msg("error writing output health")
+			zlog.Error().Err(err).Str(ecs.PolicyOutputName, outputName).Msg("error writing output health")
 		}
 	}
 }
diff --git a/magefile.go b/magefile.go
index eb139e27fe..314ecd8c40 100644
--- a/magefile.go
+++ b/magefile.go
@@ -1859,7 +1859,7 @@ func validateCertUnpacking() error {
 		},
 	}
 
-	_, err := tlscommon.LoadTLSConfig(&config)
+	_, err := tlscommon.LoadTLSConfig(&config, logp.NewNopLogger())
 	if err != nil {
 		log.Printf("tlscommon load error: %v", err)
 		passphrase, err := os.ReadFile(passFile)