|
| 1 | +[[integration-level-outputs]] |
| 2 | += Set integration-level outputs |
| 3 | + |
| 4 | +If you have an `Enterprise` link:https://www.elastic.co/subscriptions[{stack} subscription], you can configure {agent} data to be sent to different outputs for different integration policies. |
| 5 | +Integration-level outputs are very useful for certain scenarios. |
| 6 | +For example: |
| 7 | + |
| 8 | +* You can may want to send security logs monitored by an {agent} to one {ls} output, while informational logs are sent to a another {ls} output. |
| 9 | +* If you operate multiple {beats} on a system and want to migrate these to {agent}, integration-level outputs enable you to maintain the distinct outputs that are currently used by each Beat. |
| 10 | + |
| 11 | +[discrete] |
| 12 | +== Order of precedence |
| 13 | + |
| 14 | +For each {agent}, the agent policy configures sending data to the following outputs in decreasing order of priority: |
| 15 | + |
| 16 | +. The output set in the <<add-integration-to-policy,integration policy>>. |
| 17 | +. The output set in the integration's parent <<agent-policy,{agent} policy>>. |
| 18 | +This includes the case where an integration policy belongs to multiple {agent} policies. |
| 19 | +. The global, default data output set in the <<fleet-settings,{fleet} settings>>. |
| 20 | + |
| 21 | +[discrete] |
| 22 | +== Configure the output for an integration policy |
| 23 | + |
| 24 | +To configure an integration-level output for {agent} data: |
| 25 | + |
| 26 | +. In {kib}, go to **Integrations**. |
| 27 | +. On the **Installed integrations** tab, select the integration that you'd like to update. |
| 28 | +. Open the **Integration policies** tab. |
| 29 | +. From the **Actions** menu next to the integration, select *Edit integration*. |
| 30 | +. In the **integration settings** section, expand **Advanced options**. |
| 31 | +. Use the **Output** dropdown menu to select an output specific to this integration policy. |
| 32 | +. Click **Save and continue** to confirm your changes. |
| 33 | + |
| 34 | +[discrete] |
| 35 | +== View the output configured for an integration |
| 36 | + |
| 37 | +To view which {agent} output is set for an integration policy: |
| 38 | + |
| 39 | +. In {fleet}, open the **Agent policies** tab. |
| 40 | +. Select an {agent} policy. |
| 41 | +. On the **Integrations** tab, the **Output** column indicates the output used for each integration policy. |
| 42 | +If data is configured to be sent to either the global output defined in {fleet} settings or to the integration's parent {agent} policy, this is indicated in a tooltip. |
| 43 | + |
| 44 | + |
| 45 | + |
| 46 | + |
0 commit comments