Skip to content

Commit 5e78582

Browse files
kilfoylekarenzone
andauthored
Add docs for integrations-level outputs (#1218)
* Add docs for integrations-level outputs * Add content * touchup * touchup * touchup * Update docs/en/ingest-management/integrations/integration-level-outputs.asciidoc Co-authored-by: Karen Metts <[email protected]> --------- Co-authored-by: Karen Metts <[email protected]>
1 parent 2549a4c commit 5e78582

File tree

3 files changed

+51
-0
lines changed

3 files changed

+51
-0
lines changed

docs/en/ingest-management/fleet/fleet-settings.asciidoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ are updated automatically.
6767
Add or edit output settings to specify where {agent}s send data. {agent}s
6868
use the default output if you don't select an output in the agent policy.
6969

70+
TIP: If you have an `Enterprise` link:https://www.elastic.co/subscriptions[{stack} subscription],
71+
you can configure {agent} to
72+
<<integration-level-outputs,send data to different outputs for different integration policies>>.
7073

7174
NOTE: The {ecloud} internal output is locked and cannot be edited. This
7275
output is used for internal routing to reduce external network charges when

docs/en/ingest-management/index.asciidoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,8 @@ include::integrations/install-integration-assets.asciidoc[leveloffset=+2]
199199

200200
include::integrations/view-integration-assets.asciidoc[leveloffset=+2]
201201

202+
include::integrations/integration-level-outputs.asciidoc[leveloffset=+2]
203+
202204
include::integrations/upgrade-integration.asciidoc[leveloffset=+2]
203205

204206
include::integrations/managed-integrations-content.asciidoc[leveloffset=+2]
Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
[[integration-level-outputs]]
2+
= Set integration-level outputs
3+
4+
If you have an `Enterprise` link:https://www.elastic.co/subscriptions[{stack} subscription], you can configure {agent} data to be sent to different outputs for different integration policies.
5+
Integration-level outputs are very useful for certain scenarios.
6+
For example:
7+
8+
* You can may want to send security logs monitored by an {agent} to one {ls} output, while informational logs are sent to a another {ls} output.
9+
* If you operate multiple {beats} on a system and want to migrate these to {agent}, integration-level outputs enable you to maintain the distinct outputs that are currently used by each Beat.
10+
11+
[discrete]
12+
== Order of precedence
13+
14+
For each {agent}, the agent policy configures sending data to the following outputs in decreasing order of priority:
15+
16+
. The output set in the <<add-integration-to-policy,integration policy>>.
17+
. The output set in the integration's parent <<agent-policy,{agent} policy>>.
18+
This includes the case where an integration policy belongs to multiple {agent} policies.
19+
. The global, default data output set in the <<fleet-settings,{fleet} settings>>.
20+
21+
[discrete]
22+
== Configure the output for an integration policy
23+
24+
To configure an integration-level output for {agent} data:
25+
26+
. In {kib}, go to **Integrations**.
27+
. On the **Installed integrations** tab, select the integration that you'd like to update.
28+
. Open the **Integration policies** tab.
29+
. From the **Actions** menu next to the integration, select *Edit integration*.
30+
. In the **integration settings** section, expand **Advanced options**.
31+
. Use the **Output** dropdown menu to select an output specific to this integration policy.
32+
. Click **Save and continue** to confirm your changes.
33+
34+
[discrete]
35+
== View the output configured for an integration
36+
37+
To view which {agent} output is set for an integration policy:
38+
39+
. In {fleet}, open the **Agent policies** tab.
40+
. Select an {agent} policy.
41+
. On the **Integrations** tab, the **Output** column indicates the output used for each integration policy.
42+
If data is configured to be sent to either the global output defined in {fleet} settings or to the integration's parent {agent} policy, this is indicated in a tooltip.
43+
44+
45+
46+

0 commit comments

Comments
 (0)